@openclaw/fs-safe 0.7.1 → 0.8.0

package/dist/json-durable-queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAiBA,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAOF,eAAO,MAAM,0CAA0C,QAAmB,CAAC;AAY3E,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAO5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAgLD,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AA4ED,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAsBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CA4Dd;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}
+{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAOF,eAAO,MAAM,0CAA0C,QAAmB,CAAC;AAY3E,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAO5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAgLD,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AA6DD,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAsBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CA8Dd;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}

package/dist/json-durable-queue.js

@@ -1,11 +1,12 @@
 import fs, {} from "node:fs";
 import path from "node:path";
 import { normalizeMaxBytes } from "./byte-budget.js";
+import { syncDirectory } from "./directory-durability.js";
 import { syncQueueDirectoryCreation } from "./json-durable-queue-directory.js";
 import { acknowledgeDurableQueueEntry, claimDurableQueueEntry, completeDeliveredQueueEntry, moveDurableQueueEntryToFailed, } from "./json-durable-queue-ownership.js";
 import { stringifyJsonDocument } from "./json-stringify.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
-import { replaceFileAtomic } from "./replace-file.js";
+import { replaceFileAtomicWithDirectorySync } from "./replace-file.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
 export const DEFAULT_JSON_DURABLE_QUEUE_ENTRY_MAX_BYTES = 16 * 1024 * 1024;
@@ -209,24 +210,13 @@ async function chmodQueueDirectory(dir) {
     }
 }
 export async function writeJsonDurableQueueEntry(params) {
-    await replaceFileAtomic({
+    await replaceFileAtomicWithDirectorySync({
         filePath: params.filePath,
         content: stringifyJsonDocument(params.entry, null, 2),
         mode: 0o600,
         tempPrefix: params.tempPrefix,
         syncTempFile: true,
-        syncParentDir: true,
-    });
-}
-async function replaceJsonDurableQueueEntry(params) {
-    await replaceFileAtomic({
-        filePath: params.filePath,
-        content: stringifyJsonDocument(params.entry, null, 2),
-        mode: 0o600,
-        tempPrefix: params.tempPrefix,
-        syncTempFile: true,
-        syncParentDir: true,
-    });
+    }, syncDirectory);
 }
 async function inspectQueueEntry(inspect, maxBytes, expected) {
     let inspectionFailed = false;
@@ -303,7 +293,7 @@ export async function loadJsonDurableQueueEntry(params) {
         });
         const result = params.read ? await params.read(raw, params.paths.jsonPath) : { entry: raw };
         if (result.migrated) {
-            await replaceJsonDurableQueueEntry({
+            await writeJsonDurableQueueEntry({
                 filePath: claimedPath,
                 entry: result.entry,
                 tempPrefix: params.tempPrefix,
@@ -350,6 +340,12 @@ export async function loadPendingJsonDurableQueueEntries(options) {
         if (!suffix)
             continue;
         const id = file.slice(0, -suffix.length);
+        try {
+            assertSafeQueueEntryId(id);
+        }
+        catch {
+            continue;
+        }
         if (seenIds.has(id))
             continue;
         seenIds.add(id);
@@ -357,25 +353,26 @@ export async function loadPendingJsonDurableQueueEntries(options) {
     }
     const entries = [];
     for (const id of ids) {
+        const paths = resolveJsonDurableQueueEntryPaths(options.queueDir, id);
+        const claimedPath = await claimDurableQueueEntry(paths, { skipUnowned: true });
+        if (!claimedPath)
+            continue;
+        let result;
         try {
-            const paths = resolveJsonDurableQueueEntryPaths(options.queueDir, id);
-            const claimedPath = await claimDurableQueueEntry(paths);
-            if (!claimedPath)
-                continue;
             const raw = await readJsonDurableQueueEntry(claimedPath, { maxBytes: options.maxBytes });
-            const result = options.read ? await options.read(raw, paths.jsonPath) : { entry: raw };
-            if (result.migrated) {
-                await replaceJsonDurableQueueEntry({
-                    filePath: claimedPath,
-                    entry: result.entry,
-                    tempPrefix: options.tempPrefix,
-                });
-            }
-            entries.push(result.entry);
+            result = options.read ? await options.read(raw, paths.jsonPath) : { entry: raw };
         }
         catch {
             continue;
         }
+        if (result.migrated) {
+            await writeJsonDurableQueueEntry({
+                filePath: claimedPath,
+                entry: result.entry,
+                tempPrefix: options.tempPrefix,
+            });
+        }
+        entries.push(result.entry);
     }
     return entries;
 }

package/dist/local-roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAOA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAqGF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CA6B7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA4CtC"}
+{"version":3,"file":"local-roots.d.ts","sourceRoot":"","sources":["../src/local-roots.ts"],"names":[],"mappings":"AAQA,OAAO,EAAQ,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE3F,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oCAAoC,GAAG,sBAAsB,GAAG;IAC1E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,sBAAsB,GAAG;IACnE,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAgDF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oCAAoC,GAC5C,oBAAoB,GAAG,IAAI,CAuC7B;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA4CtC"}

package/dist/local-roots.js

@@ -5,6 +5,7 @@ import { FsSafeError } from "./errors.js";
 import { expandHomePrefix, resolveUserPath } from "./home-dir.js";
 import { isFileUrl, safeFileURLToPath } from "./local-file-access.js";
 import { isPathInside } from "./path.js";
+import { resolveRootPathSync } from "./root-path.js";
 import { root } from "./root.js";
 function resolveLocalPathInput(input, label) {
     if (isFileUrl(input)) {
@@ -37,9 +38,6 @@ function resolveLocalRootInput(input, label) {
     }
     return path.resolve(resolved);
 }
-function isPathInsideRoot(candidate, rootDir) {
-    return isPathInside(rootDir, candidate);
-}
 function resolveRootRealSync(rootDir) {
     try {
         // Configured roots may themselves be symlinks. Follow only this trusted
@@ -54,53 +52,6 @@ function resolveRootRealSync(rootDir) {
         return null;
     }
 }
-function resolveCandidateCanonicalSync(filePath) {
-    let sawExistingLeaf = false;
-    try {
-        const stat = fsSync.lstatSync(filePath);
-        sawExistingLeaf = true;
-        return {
-            exists: true,
-            canonicalPath: fsSync.realpathSync(filePath),
-            isFile: stat.isFile(),
-        };
-    }
-    catch (err) {
-        if (err.code !== "ENOENT") {
-            throw err;
-        }
-    }
-    if (sawExistingLeaf) {
-        // lstat succeeded but realpath failed: this is an existing dangling
-        // symlink, not a missing path callers may safely create through.
-        throw new FsSafeError("symlink", "local roots candidate is a dangling symlink");
-    }
-    let cursor = filePath;
-    const missingSegments = [];
-    while (true) {
-        const parent = path.dirname(cursor);
-        if (parent === cursor) {
-            return { exists: false, canonicalPath: filePath };
-        }
-        missingSegments.unshift(path.basename(cursor));
-        cursor = parent;
-        try {
-            fsSync.lstatSync(cursor);
-            const ancestorReal = fsSync.realpathSync(cursor);
-            return {
-                exists: false,
-                canonicalPath: path.join(ancestorReal, ...missingSegments),
-            };
-        }
-        catch (err) {
-            if (err.code !== "ENOENT") {
-                // Existing ancestors that cannot be canonicalized are symlink/error
-                // terrain; do not reconstruct a trusted missing path through them.
-                throw err;
-            }
-        }
-    }
-}
 export function resolveLocalPathFromRootsSync(options) {
     const label = options.label ?? "local roots";
     const requestedPath = path.resolve(resolveLocalPathInput(options.filePath, "file path"));
@@ -112,7 +63,13 @@ export function resolveLocalPathFromRootsSync(options) {
         }
         let candidate;
         try {
-            candidate = resolveCandidateCanonicalSync(requestedPath);
+            candidate = resolveRootPathSync({
+                absolutePath: requestedPath,
+                rootPath: rootDir,
+                rootCanonicalPath: rootReal,
+                boundaryLabel: label,
+                rejectUnresolvedSymlinks: true,
+            });
         }
         catch {
             continue;
@@ -120,12 +77,17 @@ export function resolveLocalPathFromRootsSync(options) {
         if (!candidate.exists && options.allowMissing !== true) {
             continue;
         }
-        if (candidate.exists && options.requireFile === true && !candidate.isFile) {
-            continue;
-        }
-        if (isPathInsideRoot(candidate.canonicalPath, rootReal)) {
-            return { path: candidate.canonicalPath, root: rootReal };
+        if (candidate.exists && options.requireFile === true) {
+            try {
+                if (!fsSync.lstatSync(requestedPath).isFile()) {
+                    continue;
+                }
+            }
+            catch {
+                continue;
+            }
         }
+        return { path: candidate.canonicalPath, root: rootReal };
     }
     return null;
 }

package/dist/move-path-cleanup.d.ts

@@ -0,0 +1,43 @@
+export type EntryIdentity = {
+    ctimeMs: number;
+    dev: number;
+    ino: number;
+    mode: number;
+    mtimeMs: number;
+    nlink: number;
+    size: number;
+};
+export type CopiedEntryManifest = (EntryIdentity & {
+    children: Array<{
+        name: string;
+        manifest: CopiedEntryManifest;
+    }>;
+    kind: "directory";
+}) | (EntryIdentity & {
+    kind: "leaf";
+});
+type CleanupCopiedEntryResult = "removed" | "stale";
+type CleanupAliasGroup = {
+    expected: EntryIdentity;
+    remainingPaths: Set<string>;
+    stale: boolean;
+};
+export type CleanupCopiedEntryState = {
+    aliasGroups: Map<string, CleanupAliasGroup>;
+};
+export declare function entryIdentity(stat: {
+    ctimeMs: number;
+    dev: number;
+    ino: number;
+    mode: number;
+    mtimeMs: number;
+    nlink: number;
+    size: number;
+}): EntryIdentity;
+export declare function sameIdentity(a: EntryIdentity, b: EntryIdentity): boolean;
+export declare function sourceChangedError(sourcePath: string): Error;
+export declare function assertSourceStillMatches(sourcePath: string, identity: EntryIdentity): Promise<void>;
+export declare function createCleanupCopiedEntryState(sourcePath: string, manifest: CopiedEntryManifest): CleanupCopiedEntryState;
+export declare function cleanupCopiedEntry(sourcePath: string, manifest: CopiedEntryManifest, state: CleanupCopiedEntryState): Promise<CleanupCopiedEntryResult>;
+export {};
+//# sourceMappingURL=move-path-cleanup.d.ts.map

package/dist/move-path-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"move-path-cleanup.d.ts","sourceRoot":"","sources":["../src/move-path-cleanup.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,CAAC,aAAa,GAAG;IACf,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,CAAA;KAAE,CAAC,CAAC;IACjE,IAAI,EAAE,WAAW,CAAC;CACnB,CAAC,GACF,CAAC,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEvC,KAAK,wBAAwB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpD,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,aAAa,CAAC;IACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAC7C,CAAC;AAEF,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,aAAa,CAUhB;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAUxE;AAMD,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,KAAK,CAI5D;AAED,wBAAsB,wBAAwB,CAC5C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,aAAa,GACtB,OAAO,CAAC,IAAI,CAAC,CAIf;AA0BD,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,GAC5B,uBAAuB,CAuBzB;AAsDD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,mBAAmB,EAC7B,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAkDnC"}

package/dist/move-path-cleanup.js

@@ -0,0 +1,159 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+export function entryIdentity(stat) {
+    return {
+        ctimeMs: stat.ctimeMs,
+        dev: stat.dev,
+        ino: stat.ino,
+        mode: stat.mode,
+        mtimeMs: stat.mtimeMs,
+        nlink: stat.nlink,
+        size: stat.size,
+    };
+}
+export function sameIdentity(a, b) {
+    return (a.dev === b.dev &&
+        a.ino === b.ino &&
+        a.mode === b.mode &&
+        a.nlink === b.nlink &&
+        a.size === b.size &&
+        a.mtimeMs === b.mtimeMs &&
+        a.ctimeMs === b.ctimeMs);
+}
+function sameDirectoryNode(a, b) {
+    return a.dev === b.dev && a.ino === b.ino;
+}
+export function sourceChangedError(sourcePath) {
+    return Object.assign(new Error(`Source changed during move fallback: ${sourcePath}`), {
+        code: "ESTALE",
+    });
+}
+export async function assertSourceStillMatches(sourcePath, identity) {
+    if (!sameIdentity(identity, entryIdentity(await fs.lstat(sourcePath)))) {
+        throw sourceChangedError(sourcePath);
+    }
+}
+function identityKey(identity) {
+    return `${identity.dev}:${identity.ino}`;
+}
+function collectAliasCandidates(sourcePath, manifest, candidates) {
+    if (manifest.kind === "directory") {
+        for (const child of manifest.children) {
+            collectAliasCandidates(path.join(sourcePath, child.name), child.manifest, candidates);
+        }
+        return;
+    }
+    if (manifest.nlink <= 1) {
+        return;
+    }
+    const key = identityKey(manifest);
+    const entries = candidates.get(key) ?? [];
+    entries.push({ manifest, path: sourcePath });
+    candidates.set(key, entries);
+}
+export function createCleanupCopiedEntryState(sourcePath, manifest) {
+    const candidates = new Map();
+    collectAliasCandidates(sourcePath, manifest, candidates);
+    const aliasGroups = new Map();
+    for (const [key, entries] of candidates) {
+        if (entries.length < 2) {
+            continue;
+        }
+        const first = entries[0];
+        if (!first || entries.some((entry) => !sameIdentity(first.manifest, entry.manifest))) {
+            throw sourceChangedError(sourcePath);
+        }
+        aliasGroups.set(key, {
+            expected: first.manifest,
+            remainingPaths: new Set(entries.map((entry) => entry.path)),
+            stale: false,
+        });
+    }
+    return { aliasGroups };
+}
+function sameOwnedUnlinkTransition(before, after) {
+    return (before.dev === after.dev &&
+        before.ino === after.ino &&
+        before.mode === after.mode &&
+        before.size === after.size &&
+        before.mtimeMs === after.mtimeMs &&
+        before.nlink > 0 &&
+        after.nlink === before.nlink - 1 &&
+        after.ctimeMs >= before.ctimeMs);
+}
+function poisonAliasGroup(group) {
+    group.stale = true;
+    return "stale";
+}
+async function observeOwnedAliasUnlink(sourcePath, group) {
+    group.remainingPaths.delete(sourcePath);
+    const remainingPath = group.remainingPaths.values().next().value;
+    if (!remainingPath) {
+        return "removed";
+    }
+    let observed;
+    try {
+        observed = await fs.lstat(remainingPath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            return poisonAliasGroup(group);
+        }
+        throw error;
+    }
+    const observedIdentity = entryIdentity(observed);
+    if (!sameOwnedUnlinkTransition(group.expected, observedIdentity)) {
+        return poisonAliasGroup(group);
+    }
+    group.expected = observedIdentity;
+    return "removed";
+}
+function mergeCleanupResults(a, b) {
+    return a === "stale" || b === "stale" ? "stale" : "removed";
+}
+export async function cleanupCopiedEntry(sourcePath, manifest, state) {
+    const aliasGroup = manifest.kind === "leaf" ? state.aliasGroups.get(identityKey(manifest)) : undefined;
+    if (aliasGroup?.stale) {
+        return "stale";
+    }
+    let currentStat;
+    try {
+        currentStat = await fs.lstat(sourcePath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT") {
+            return aliasGroup ? poisonAliasGroup(aliasGroup) : "removed";
+        }
+        throw error;
+    }
+    if (manifest.kind === "directory") {
+        if (!currentStat.isDirectory() || !sameDirectoryNode(manifest, entryIdentity(currentStat))) {
+            return "stale";
+        }
+        // A same-inode directory can gain unrelated children after commit. Still
+        // clean manifest children so the fallback does not duplicate copied files.
+        let result = "removed";
+        for (const child of manifest.children) {
+            result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest, state));
+        }
+        try {
+            await fs.rmdir(sourcePath);
+        }
+        catch (error) {
+            const code = error?.code;
+            if (code === "ENOTEMPTY" || code === "EEXIST") {
+                return "stale";
+            }
+            throw error;
+        }
+        return result;
+    }
+    const expected = aliasGroup?.expected ?? manifest;
+    if (!sameIdentity(expected, entryIdentity(currentStat))) {
+        return aliasGroup ? poisonAliasGroup(aliasGroup) : "stale";
+    }
+    await fs.unlink(sourcePath);
+    return aliasGroup
+        ? await observeOwnedAliasUnlink(sourcePath, aliasGroup)
+        : "removed";
+}

package/dist/move-path.d.ts

@@ -1,4 +1,6 @@
 export type MovePathWithCopyFallbackOptions = {
+    /** Rechecks caller authority synchronously immediately before each rename dispatch. */
+    assertBeforeRename?: () => void;
     from: string;
     sourceHardlinks?: "allow" | "reject";
     to: string;

package/dist/move-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AAiVD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CA2Df"}
+{"version":3,"file":"move-path.d.ts","sourceRoot":"","sources":["../src/move-path.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,+BAA+B,GAAG;IAC5C,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AAEF,KAAK,sBAAsB,GAAG,cAAc,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,sBAAsB,GAAG,SAAS,CASpC;AA8OD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAkFf"}

package/dist/move-path.js

@@ -4,6 +4,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { guardedRename } from "./guarded-mutation.js";
+import { assertSourceStillMatches, cleanupCopiedEntry, createCleanupCopiedEntryState, entryIdentity, sameIdentity, sourceChangedError, } from "./move-path-cleanup.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 export function moveCopyFallbackReasonForRenameError(error, platform = process.platform) {
@@ -50,51 +51,34 @@ function isSameOrDescendant(parentPath, candidatePath) {
     return (relative === "" ||
         (!path.isAbsolute(relative) && !relative.startsWith(`..${path.sep}`) && relative !== ".."));
 }
-async function assertCopyDestinationOutsideSource(sourcePath, targetPath) {
-    const sourceReal = await fs.realpath(sourcePath);
+async function assertCopyDestinationOutsideSource(sourcePath, targetPath, expectedIdentity) {
+    const sourceStat = await fs.lstat(sourcePath);
+    const sourceIdentity = entryIdentity(sourceStat);
+    if (expectedIdentity && !sameIdentity(expectedIdentity, sourceIdentity)) {
+        throw sourceChangedError(sourcePath);
+    }
+    const normalizedSource = path.resolve(sourcePath);
     const normalizedTarget = path.resolve(targetPath);
-    const targetParentReal = await fs.realpath(path.dirname(normalizedTarget));
+    const [sourceParentReal, targetParentReal] = await Promise.all([
+        fs.realpath(path.dirname(normalizedSource)),
+        fs.realpath(path.dirname(normalizedTarget)),
+    ]);
+    const sourceCandidate = path.join(sourceParentReal, path.basename(normalizedSource));
     const targetCandidate = path.join(targetParentReal, path.basename(normalizedTarget));
-    if (isSameOrDescendant(sourceReal, targetCandidate)) {
+    const sourceBoundary = sourceStat.isDirectory()
+        ? await fs.realpath(sourcePath)
+        : sourceCandidate;
+    const unsafeTarget = sourceStat.isDirectory()
+        ? isSameOrDescendant(sourceBoundary, targetCandidate)
+        : path.relative(sourceBoundary, targetCandidate) === "";
+    if (unsafeTarget) {
         throw new FsSafeError("invalid-path", "Move destination must not be inside the source");
     }
-}
-function entryIdentity(stat) {
-    return {
-        ctimeMs: stat.ctimeMs,
-        dev: stat.dev,
-        ino: stat.ino,
-        mode: stat.mode,
-        mtimeMs: stat.mtimeMs,
-        nlink: stat.nlink,
-        size: stat.size,
-    };
-}
-function sameIdentity(a, b) {
-    return (a.dev === b.dev &&
-        a.ino === b.ino &&
-        a.mode === b.mode &&
-        a.nlink === b.nlink &&
-        a.size === b.size &&
-        a.mtimeMs === b.mtimeMs &&
-        a.ctimeMs === b.ctimeMs);
-}
-function sameDirectoryNode(a, b) {
-    return a.dev === b.dev && a.ino === b.ino;
+    return sourceIdentity;
 }
 function modeBits(mode) {
     return mode & 0o777;
 }
-function sourceChangedError(sourcePath) {
-    return Object.assign(new Error(`Source changed during move fallback: ${sourcePath}`), {
-        code: "ESTALE",
-    });
-}
-async function assertSourceStillMatches(sourcePath, identity) {
-    if (!sameIdentity(identity, entryIdentity(await fs.lstat(sourcePath)))) {
-        throw sourceChangedError(sourcePath);
-    }
-}
 async function chmodDirectoryPinned(directoryPath, mode) {
     if (process.platform === "win32") {
         // Node cannot portably open a Windows directory for descriptor-bound
@@ -174,9 +158,12 @@ async function copyRegularFilePinned(params) {
         await sourceHandle.close();
     }
 }
-async function copyEntryWithManifest(from, to, options) {
+async function copyEntryWithManifest(from, to, options, expectedIdentity) {
     const sourceStat = await fs.lstat(from);
     const identity = entryIdentity(sourceStat);
+    if (expectedIdentity && !sameIdentity(expectedIdentity, identity)) {
+        throw sourceChangedError(from);
+    }
     if (sourceStat.isSymbolicLink()) {
         await fs.symlink(await fs.readlink(from), to);
         // readlink() is path-based; verify the symlink we copied is still the one
@@ -224,49 +211,24 @@ async function copyEntryWithManifest(from, to, options) {
     });
     return { ...identity, kind: "leaf" };
 }
-function mergeCleanupResults(a, b) {
-    return a === "stale" || b === "stale" ? "stale" : "removed";
-}
-async function cleanupCopiedEntry(sourcePath, manifest) {
-    let currentStat;
-    try {
-        currentStat = await fs.lstat(sourcePath);
-    }
-    catch (error) {
-        if (error?.code === "ENOENT") {
-            return "removed";
-        }
-        throw error;
-    }
-    if (manifest.kind === "directory") {
-        if (!currentStat.isDirectory() || !sameDirectoryNode(manifest, entryIdentity(currentStat))) {
-            return "stale";
-        }
-        // A same-inode directory can gain unrelated children after commit. Still
-        // clean manifest children so the fallback does not duplicate copied files.
-        let result = "removed";
-        for (const child of manifest.children) {
-            result = mergeCleanupResults(result, await cleanupCopiedEntry(path.join(sourcePath, child.name), child.manifest));
-        }
+export async function movePathWithCopyFallback(options) {
+    // Keep the initiating owner's callback across preparation and copy fallback.
+    const callerAssert = options.assertBeforeRename;
+    let assertionRejected = false;
+    const assertBeforeRename = () => {
         try {
-            await fs.rmdir(sourcePath);
+            const returned = callerAssert?.();
+            if (returned !== undefined) {
+                // TypeScript permits async functions for () => void; they cannot authorize a rename.
+                void Promise.resolve(returned).catch(() => { });
+                throw new TypeError("assertBeforeRename must return undefined synchronously");
+            }
         }
         catch (error) {
-            const code = error?.code;
-            if (code === "ENOTEMPTY" || code === "EEXIST") {
-                return "stale";
-            }
+            assertionRejected = true;
             throw error;
         }
-        return result;
-    }
-    if (!sameIdentity(manifest, entryIdentity(currentStat))) {
-        return "stale";
-    }
-    await fs.unlink(sourcePath);
-    return "removed";
-}
-export async function movePathWithCopyFallback(options) {
+    };
     const sourcePath = path.resolve(options.from);
     const targetPath = path.resolve(options.to);
     const rejectHardlinks = options.sourceHardlinks === "reject";
@@ -275,11 +237,12 @@ export async function movePathWithCopyFallback(options) {
     }
     if (!rejectHardlinks) {
         try {
-            await guardedRename({ from: sourcePath, to: targetPath });
+            await guardedRename({ from: sourcePath, to: targetPath, assertBeforeRename });
             return;
         }
         catch (error) {
-            if (!moveCopyFallbackReasonForRenameError(error)) {
+            // An owner's EXDEV/EPERM refusal is not permission to copy instead.
+            if (assertionRejected || !moveCopyFallbackReasonForRenameError(error)) {
                 throw error;
             }
         }
@@ -289,7 +252,7 @@ export async function movePathWithCopyFallback(options) {
         // Commit a fresh inode through the copy path so a post-scan hardlink can
         // never become the published target; the copy loop fences nlink again.
     }
-    await assertCopyDestinationOutsideSource(sourcePath, targetPath);
+    const sourceIdentity = await assertCopyDestinationOutsideSource(sourcePath, targetPath);
     const targetDir = path.dirname(targetPath);
     const staged = path.join(targetDir, `.fs-safe-move-${process.pid}-${randomUUID()}.tmp`);
     const unregisterStaged = registerTempPathForExit(staged, { recursive: true });
@@ -298,13 +261,14 @@ export async function movePathWithCopyFallback(options) {
         const manifest = await copyEntryWithManifest(sourcePath, staged, {
             sourceHardlinks: options.sourceHardlinks ?? "allow",
             ...(rejectHardlinks ? { budget: { discovered: 1 } } : {}),
-        });
+        }, sourceIdentity);
+        const cleanupState = createCleanupCopiedEntryState(sourcePath, manifest);
         unregisterStaged.setIdentity(await fs.lstat(staged, { bigint: true }));
-        await assertCopyDestinationOutsideSource(sourcePath, targetPath);
-        await guardedRename({ from: staged, to: targetPath });
+        await assertCopyDestinationOutsideSource(sourcePath, targetPath, manifest);
+        await guardedRename({ from: staged, to: targetPath, assertBeforeRename });
         stagedCommitted = true;
         unregisterStaged();
-        const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest);
+        const cleanupResult = await cleanupCopiedEntry(sourcePath, manifest, cleanupState);
         if (cleanupResult === "stale") {
             throw sourceChangedError(sourcePath);
         }

package/dist/native-operations.d.ts

@@ -1,6 +1,5 @@
-import { type Stats } from "node:fs";
+import { type BigIntStats, type Stats } from "node:fs";
 import type { ContainmentGuarantee } from "./containment.js";
-import { type NativeBinding } from "./native.js";
 import type { PinnedWriteInput } from "./pinned-write.js";
 export type NativeFileHandle = {
     readonly fd: number;
@@ -13,11 +12,10 @@ export declare function nativeOpenFlags(flags: number): number;
 export declare function writeNativeFd(fd: number, data: Buffer): void;
 export declare function writeNativeInput(fd: number, input: PinnedWriteInput, maxBytes?: number): Promise<void>;
 export declare function removeNativeCreatedFileIfStillPinned(params: {
-    binding: NativeBinding;
     parentPath: string;
     parentFd: number;
     basename: string;
-    created?: Stats;
+    created?: BigIntStats;
 }): void;
 export declare function createNativeExclusiveFile(targetPath: string, mode: number): Promise<NativeFileHandle | undefined>;
 export declare function syncNativeFileBestEffort(fd: number): void;