@openclaw/fs-safe 0.8.6 → 0.10.0

package/dist/pinned-write.js

@@ -17,6 +17,10 @@ import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { cleanupPinnedFilePath } from "./replace-file-temp-owner.js";
 import { withSidecarLock } from "./sidecar-lock.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
+import { writeAllToFile } from "./write-file-handle.js";
+import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
+import { writeCopyFileToFd } from "./copy-file-input.js";
+import { publishCopyStage } from "./publish-copy-stage.js";
 function byteLength(input, encoding) {
     return typeof input === "string"
         ? Buffer.byteLength(input, encoding ?? "utf8")
@@ -36,20 +40,13 @@ function assertWithinMaxBytes(bytes, maxBytes) {
         throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
 }
-async function writeStreamToHandle(stream, handle, maxBytes) {
+async function writeStreamToHandle(stream, handle, maxBytes, assertBeforeMutation) {
     let bytes = 0;
     for await (const chunk of stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         bytes += buffer.byteLength;
         assertWithinMaxBytes(bytes, maxBytes);
-        let offset = 0;
-        while (offset < buffer.byteLength) {
-            const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset);
-            if (bytesWritten <= 0) {
-                throw new FsSafeError("helper-failed", "fallback stream write made no progress");
-            }
-            offset += bytesWritten;
-        }
+        await writeAllToFile(handle, buffer, { assertBeforeMutation });
     }
 }
 export async function runPinnedWriteHelper(params) {
@@ -95,7 +92,6 @@ async function runPinnedWriteFallback(params) {
         ? { dev: params.rootIdentity.dev, ino: params.rootIdentity.ino } : undefined;
     if (exactRoot)
         await inspectDirectoryIdentity(params.rootPath, exactRoot);
-    const guardOptions = { bigint: exactRoot !== undefined };
     let parentPath = params.relativeParentPath
         ? path.join(params.rootPath, ...params.relativeParentPath.split("/"))
         : params.rootPath;
@@ -107,15 +103,23 @@ async function runPinnedWriteFallback(params) {
         parentPath = await mkdirPathComponentsWithGuards({
             rootReal: params.rootPath,
             targetPath: parentPath,
+            assertBeforeMutation: params.assertBeforeMutation,
             beforeComponent: async (componentPath) => await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("mkdir", componentPath),
         });
     }
     const parentGuard = params.mkdir
-        ? await createAsyncDirectoryGuard(parentPath, guardOptions)
-        : await createNearestExistingDirectoryGuard(params.rootPath, parentPath, guardOptions);
+        ? await createAsyncDirectoryGuard(parentPath, { bigint: true })
+        : await createNearestExistingDirectoryGuard(params.rootPath, parentPath, { bigint: true });
     const targetPath = path.join(parentPath, params.basename);
-    if (params.overwrite === false) {
-        const handle = await withAsyncDirectoryGuards([parentGuard], async () => await fs.open(targetPath, fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL, params.mode), {
+    if (params.overwrite === false && params.input.kind !== "file") {
+        const assertBeforeMutation = () => {
+            assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);
+            params.assertBeforeMutation?.();
+        };
+        const handle = await withAsyncDirectoryGuards([parentGuard], async () => {
+            assertBeforeMutation();
+            return await fs.open(targetPath, fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL, params.mode);
+        }, {
             onPostGuardFailure: async (openedHandle) => {
                 // The parent failed verification, so targetPath may now resolve
                 // somewhere else. Close the fd, but do not clean up by path.
@@ -129,15 +133,12 @@ async function runPinnedWriteFallback(params) {
             createdIdentity = verificationIdentity;
             if (params.input.kind === "buffer") {
                 assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
-                if (typeof params.input.data === "string") {
-                    await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
-                }
-                else {
-                    await handle.writeFile(params.input.data);
-                }
+                await writeAllToFile(handle, params.input.data, {
+                    encoding: params.input.encoding, assertBeforeMutation,
+                });
             }
             else {
-                await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
+                await writeStreamToHandle(params.input.stream, handle, params.maxBytes, assertBeforeMutation);
             }
             // Content writes may clear set-ID bits; finalize them through the owned fd.
             await handle.chmod(params.mode);
@@ -176,20 +177,21 @@ async function runPinnedWriteFallback(params) {
     let readHandle;
     let renamed = false;
     try {
+        params.assertBeforeMutation?.();
         handle = await fs.open(tempPath, tempFlags, params.mode);
         let verificationIdentity = fsSync.fstatSync(handle.fd, { bigint: true });
         tempIdentity = verificationIdentity;
         if (params.input.kind === "buffer") {
             assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
-            if (typeof params.input.data === "string") {
-                await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
-            }
-            else {
-                await handle.writeFile(params.input.data);
-            }
+            await writeAllToFile(handle, params.input.data, {
+                encoding: params.input.encoding, assertBeforeMutation: params.assertBeforeMutation,
+            });
+        }
+        else if (params.input.kind === "file") {
+            await writeCopyFileToFd(handle.fd, params.input, params.maxBytes, params.assertBeforeMutation);
         }
         else {
-            await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
+            await writeStreamToHandle(params.input.stream, handle, params.maxBytes, params.assertBeforeMutation);
         }
         tempStat = fsSync.fstatSync(handle.fd);
         const tempPathStat = fsSync.lstatSync(tempPath);
@@ -200,10 +202,28 @@ async function runPinnedWriteFallback(params) {
         await handle.chmod(params.mode);
         if (params.sync !== false)
             await syncFileBestEffort(handle);
+        if (params.input.kind === "file")
+            await params.input.verifySource();
         let verifiedIdentity = expectedTempStat;
         await withAsyncDirectoryGuards([parentGuard], async () => {
-            await fs.rename(tempPath, targetPath);
-            renamed = true;
+            assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);
+            if (params.overwrite === false) {
+                publishCopyStage({
+                    temporaryPath: tempPath, targetPath, fd: handle.fd,
+                    identity: tempIdentity, parentGuard,
+                    assertBeforeMutation: params.assertBeforeMutation,
+                    onPublished: (identity) => {
+                        renamed = true;
+                        params.onPublished?.(identity);
+                    },
+                });
+            }
+            else {
+                params.assertBeforeMutation?.();
+                await fs.rename(tempPath, targetPath);
+                renamed = true;
+                params.onPublished?.(verificationIdentity);
+            }
             await getFsSafeTestHooks()?.afterPinnedWriteFallbackRename?.(targetPath);
             if (params.sync !== false)
                 await syncDirectoryBestEffort(parentPath);

package/dist/positional-read.d.ts

@@ -0,0 +1,9 @@
+import type { FileHandle } from "node:fs/promises";
+export type ReadFileWindowOptions = {
+    signal?: AbortSignal;
+};
+/** Fills a caller-owned buffer from an explicit position, stopping at EOF. */
+export declare function readFileWindowFully(handle: FileHandle, buffer: Buffer, position: number, { signal }?: ReadFileWindowOptions): Promise<number>;
+/** Synchronous positional read; neither variant advances or closes its descriptor. */
+export declare function readFileWindowFullySync(fd: number, buffer: Buffer, position: number): number;
+//# sourceMappingURL=positional-read.d.ts.map

package/dist/positional-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"positional-read.d.ts","sourceRoot":"","sources":["../src/positional-read.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AASF,8EAA8E;AAC9E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,EAAE,MAAM,EAAE,GAAE,qBAA0B,GACrC,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,sFAAsF;AACtF,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5F"}

package/dist/positional-read.js

@@ -0,0 +1,36 @@
+import fs from "node:fs";
+// Node's synchronous read length is a signed 32-bit value on supported runtimes.
+const MAX_READ_BYTES = 0x7fffffff;
+function validateWindow(buffer, position) {
+    if (!Number.isSafeInteger(position) || position < 0 ||
+        !Number.isSafeInteger(position + buffer.length)) {
+        throw new RangeError("read position and window end must be non-negative safe integers");
+    }
+}
+/** Fills a caller-owned buffer from an explicit position, stopping at EOF. */
+export async function readFileWindowFully(handle, buffer, position, { signal } = {}) {
+    validateWindow(buffer, position);
+    signal?.throwIfAborted();
+    let total = 0;
+    while (total < buffer.length) {
+        const { bytesRead } = await handle.read(buffer, total, Math.min(buffer.length - total, MAX_READ_BYTES), position + total);
+        // Settle the pending read before cancellation lets the caller reuse its buffer or handle.
+        signal?.throwIfAborted();
+        if (bytesRead === 0)
+            break;
+        total += bytesRead;
+    }
+    return total;
+}
+/** Synchronous positional read; neither variant advances or closes its descriptor. */
+export function readFileWindowFullySync(fd, buffer, position) {
+    validateWindow(buffer, position);
+    let total = 0;
+    while (total < buffer.length) {
+        const bytesRead = fs.readSync(fd, buffer, total, Math.min(buffer.length - total, MAX_READ_BYTES), position + total);
+        if (bytesRead === 0)
+            break;
+        total += bytesRead;
+    }
+    return total;
+}

package/dist/private-temp-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-temp-workspace.d.ts","sourceRoot":"","sources":["../src/private-temp-workspace.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,IAAI,0BAA0B,CAAC;IACtC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AAuKF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,iBAAiB,CAgGnB;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,GACvC,CAAC,CAUH"}
+{"version":3,"file":"private-temp-workspace.d.ts","sourceRoot":"","sources":["../src/private-temp-workspace.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,IAAI,0BAA0B,CAAC;IACtC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AA4KF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,iBAAiB,CAgGnB;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,GACvC,CAAC,CAUH"}

package/dist/private-temp-workspace.js

@@ -67,7 +67,7 @@ function throwTempWorkspaceOpenFailure(failure) {
 }
 async function ensurePrivateDirectory(dir, mode) {
     await fs.mkdir(dir, { recursive: true, mode });
-    const stat = await fs.stat(dir);
+    const stat = fsSync.statSync(dir);
     if (!stat.isDirectory()) {
         throw new Error(`Temp root must be a directory: ${dir}`);
     }
@@ -91,7 +91,13 @@ async function createTempWorkspace(options) {
     const mode = options.mode ?? 0o600;
     const cleanupSafety = resolveTempWorkspaceCleanupSafety(options.cleanupSafety);
     const requestedRoot = path.resolve(options.rootDir);
-    const root = await fs.realpath(requestedRoot).catch(() => requestedRoot);
+    let root = requestedRoot;
+    try {
+        root = fsSync.realpathSync.native(requestedRoot);
+    }
+    catch {
+        root = requestedRoot;
+    }
     await ensurePrivateDirectory(root, dirMode);
     const capability = new TempWorkspaceCleanupCapability(root, cleanupSafety);
     let dir;
@@ -101,7 +107,7 @@ async function createTempWorkspace(options) {
     try {
         dir = await fs.mkdtemp(path.join(root, sanitizeTempPrefix(options.prefix)));
         await fs.chmod(dir, dirMode).catch(() => undefined);
-        stat = await fs.lstat(dir, { bigint: true });
+        stat = fsSync.lstatSync(dir, { bigint: true });
         if (stat.isSymbolicLink() || !stat.isDirectory()) {
             throw new Error(`Temp workspace must be a directory: ${dir}`);
         }

package/dist/publish-copy-stage.d.ts

@@ -0,0 +1,13 @@
+import { type BigIntStats } from "node:fs";
+import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
+import type { PublishedWriteIdentity } from "./pinned-write.js";
+export declare function publishCopyStage(params: {
+    temporaryPath: string;
+    targetPath: string;
+    fd: number;
+    identity: BigIntStats;
+    parentGuard: AnyAsyncDirectoryGuard;
+    assertBeforeMutation?: () => void;
+    onPublished?: (identity: PublishedWriteIdentity) => void;
+}): void;
+//# sourceMappingURL=publish-copy-stage.d.ts.map

package/dist/publish-copy-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-copy-stage.d.ts","sourceRoot":"","sources":["../src/publish-copy-stage.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAIhE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,EAAE,sBAAsB,CAAC;IACpC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,IAAI,CAAC;CAC1D,GAAG,IAAI,CAqCP"}

package/dist/publish-copy-stage.js

@@ -0,0 +1,47 @@
+import fs, {} from "node:fs";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+// Node has no portable no-replace rename. Link only our completed private stage,
+// then unlink it in the same JS turn so local readers never observe two names.
+export function publishCopyStage(params) {
+    const { identity, temporaryPath, targetPath } = params;
+    const staged = fs.lstatSync(temporaryPath, { bigint: true });
+    const opened = fs.fstatSync(params.fd, { bigint: true });
+    if (!staged.isFile() || staged.isSymbolicLink() || staged.nlink !== 1n ||
+        !sameFileIdentityForCleanup(staged, identity) ||
+        !sameFileIdentityForCleanup(opened, identity)) {
+        throw new FsSafeError("path-mismatch", "exclusive copy stage changed before publication");
+    }
+    params.assertBeforeMutation?.();
+    fs.linkSync(temporaryPath, targetPath);
+    let observerRejected = false;
+    let observerError;
+    try {
+        params.onPublished?.(identity);
+    }
+    catch (error) {
+        observerRejected = true;
+        observerError = error;
+    }
+    try {
+        const parent = fs.lstatSync(path.dirname(temporaryPath), { bigint: true });
+        const current = fs.lstatSync(temporaryPath, { bigint: true });
+        if (parent.isSymbolicLink() || !parent.isDirectory() ||
+            !sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
+            current.isSymbolicLink() || !current.isFile() ||
+            !sameFileIdentityForCleanup(current, identity)) {
+            throw new FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+        }
+        // This removes the stage's name, never the published destination or source.
+        fs.unlinkSync(temporaryPath);
+    }
+    catch (error) {
+        throw new FsSafeError("helper-failed", "published copy temporary cleanup failed", {
+            cause: observerRejected ? new AggregateError([observerError, error], "observer and cleanup failed") : error,
+            details: { publication: "published", path: targetPath, dev: identity.dev, ino: identity.ino, cleanup: "failed" },
+        });
+    }
+    if (observerRejected)
+        throw observerError;
+}

package/dist/publish-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA0ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}
+{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA2ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}

package/dist/publish-file.js

@@ -40,8 +40,8 @@ async function openNativeParent(filePath) {
     const parentPath = path.dirname(filePath);
     const handle = await fs.open(parentPath, directoryOpenFlags());
     try {
-        const pathname = await fs.lstat(parentPath, { bigint: true });
-        const opened = await handle.stat({ bigint: true });
+        const pathname = fsSync.lstatSync(parentPath, { bigint: true });
+        const opened = fsSync.fstatSync(handle.fd, { bigint: true });
         if (pathname.isSymbolicLink() || !sameFileIdentity(pathname, opened)) {
             throw new FsSafeError("path-mismatch", "publication parent changed while opening");
         }
@@ -55,8 +55,8 @@ async function openNativeParent(filePath) {
 async function assertPinnedSourceCurrent(params) {
     // Windows file indexes can exceed Number.MAX_SAFE_INTEGER, so publication
     // fences must compare bigint stats instead of rounded numeric identities.
-    const opened = await params.handle.stat({ bigint: true });
-    const current = await fs.lstat(params.sourcePath, { bigint: true });
+    const opened = fsSync.fstatSync(params.handle.fd, { bigint: true });
+    const current = fsSync.lstatSync(params.sourcePath, { bigint: true });
     if (!opened.isFile() ||
         current.isSymbolicLink() ||
         !current.isFile() ||
@@ -90,15 +90,15 @@ async function copyPinnedSource(params) {
                 throw error;
             }
             let target;
-            let createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
-            rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
             try {
+                let createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
+                rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
                 fsSync.fchmodSync(nativeFd, 0o600);
                 createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
                 await getFsSafeTestHooks()?.afterPublishTargetCreated?.("exclusive-copy", params.targetPath, createdIdentity);
-                const identity = await fs.lstat(params.targetPath, { bigint: true });
+                const identity = fsSync.lstatSync(params.targetPath, { bigint: true });
                 target = await fs.open(params.targetPath, sourceOpenFlags());
-                const opened = await target.stat({ bigint: true });
+                const opened = fsSync.fstatSync(target.fd, { bigint: true });
                 if (identity.isSymbolicLink() ||
                     !identity.isFile() ||
                     !sameFileIdentity(createdIdentity, identity) ||
@@ -106,8 +106,9 @@ async function copyPinnedSource(params) {
                     throw new FsSafeError("path-mismatch", "native publication target changed after copy");
                 }
                 const hashed = await hashFileHandle(target, params.native);
-                fsSync.closeSync(nativeFd);
+                const completedFd = nativeFd;
                 nativeFd = undefined;
+                fsSync.closeSync(completedFd);
                 return {
                     handle: target,
                     exactIdentity: opened,
@@ -126,11 +127,11 @@ async function copyPinnedSource(params) {
         }
     }
     const target = await fs.open(params.targetPath, "wx+", 0o600);
-    const createdIdentity = await target.stat({ bigint: true });
-    rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
     try {
+        const createdIdentity = fsSync.fstatSync(target.fd, { bigint: true });
+        rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
         await target.chmod(0o600);
-        const exactIdentity = await target.stat({ bigint: true });
+        const exactIdentity = fsSync.fstatSync(target.fd, { bigint: true });
         await getFsSafeTestHooks()?.afterPublishTargetCreated?.("exclusive-copy", params.targetPath, exactIdentity);
         const hash = createHash("sha256");
         const buffer = Buffer.allocUnsafe(64 * 1024);
@@ -164,7 +165,7 @@ async function removeCreatedTargetIfUnchanged(targetPath, identity) {
         return "unknown";
     }
     try {
-        const current = await fs.lstat(targetPath, { bigint: true });
+        const current = fsSync.lstatSync(targetPath, { bigint: true });
         if (!current.isSymbolicLink() && sameFileIdentityForCleanup(current, identity)) {
             await fs.rm(targetPath);
             return "removed";
@@ -195,7 +196,7 @@ export async function publishFileExclusive(params) {
     if (params.parentReceipt && path.resolve(params.parentReceipt.path) !== parentPath) {
         throw new FsSafeError("path-mismatch", "publication parent receipt does not match target parent");
     }
-    const sourcePathStat = await fs.lstat(sourcePath);
+    const sourcePathStat = fsSync.lstatSync(sourcePath);
     if (sourcePathStat.isSymbolicLink() || !sourcePathStat.isFile()) {
         throw new FsSafeError("not-file", "publication source must be a regular file");
     }
@@ -212,9 +213,9 @@ export async function publishFileExclusive(params) {
         parent = await pinDirectory(params.parentReceipt ?? parentPath, {
             label: "publication parent",
         });
-        const sourceIdentity = await source.stat();
-        const sourceExactIdentity = await source.stat({ bigint: true });
-        const sourcePathExactIdentity = await fs.lstat(sourcePath, { bigint: true });
+        const sourceIdentity = fsSync.fstatSync(source.fd);
+        const sourceExactIdentity = fsSync.fstatSync(source.fd, { bigint: true });
+        const sourcePathExactIdentity = fsSync.lstatSync(sourcePath, { bigint: true });
         if (sourcePathExactIdentity.isSymbolicLink() ||
             !sourcePathExactIdentity.isFile() ||
             !sameFileIdentity(sourcePathExactIdentity, sourceExactIdentity) ||
@@ -241,14 +242,14 @@ export async function publishFileExclusive(params) {
             // A failed post-rename fence must not delete the only remaining name.
             failure.preserveTarget = true;
             await getFsSafeTestHooks()?.afterPublishTargetCreated?.("rename-noreplace", targetPath, sourceExactIdentity);
-            const targetExactIdentity = await fs.lstat(targetPath, { bigint: true });
+            const targetExactIdentity = fsSync.lstatSync(targetPath, { bigint: true });
             if (targetExactIdentity.isSymbolicLink() ||
                 !targetExactIdentity.isFile() ||
                 !sameFileIdentity(targetExactIdentity, sourceExactIdentity)) {
                 throw new FsSafeError("path-mismatch", "no-replace publication target changed");
             }
             try {
-                await fs.lstat(sourcePath);
+                fsSync.lstatSync(sourcePath);
                 throw new FsSafeError("path-mismatch", "no-replace publication source still exists");
             }
             catch (error) {
@@ -257,7 +258,7 @@ export async function publishFileExclusive(params) {
                 }
             }
             syncFileBestEffortSync(sourceNativeParent.handle.fd);
-            const targetIdentity = await fs.lstat(targetPath);
+            const targetIdentity = fsSync.lstatSync(targetPath);
             return {
                 method: "rename-noreplace",
                 identity: targetIdentity,
@@ -278,14 +279,14 @@ export async function publishFileExclusive(params) {
             }
             rememberCreatedTarget(failure, sourceExactIdentity, "hardlink-verify");
             await getFsSafeTestHooks()?.afterPublishTargetCreated?.("hardlink", targetPath, sourceExactIdentity);
-            const targetExactIdentity = await fs.lstat(targetPath, { bigint: true });
+            const targetExactIdentity = fsSync.lstatSync(targetPath, { bigint: true });
             if (targetExactIdentity.isSymbolicLink() ||
                 !targetExactIdentity.isFile() ||
                 !sameFileIdentity(targetExactIdentity, sourceExactIdentity)) {
                 throw new FsSafeError("path-mismatch", "hardlink publication target changed");
             }
             await assertPinnedSourceCurrent({ sourcePath, handle: source, identity: sourceExactIdentity });
-            const targetIdentity = await fs.lstat(targetPath);
+            const targetIdentity = fsSync.lstatSync(targetPath);
             return {
                 method: "hardlink",
                 identity: targetIdentity,
@@ -316,9 +317,9 @@ export async function publishFileExclusive(params) {
                 failure,
             });
             target = copied.handle;
-            targetIdentity = await target.stat();
-            const targetPathStat = await fs.lstat(targetPath);
-            const targetPathExactStat = await fs.lstat(targetPath, { bigint: true });
+            targetIdentity = fsSync.fstatSync(target.fd);
+            const targetPathStat = fsSync.lstatSync(targetPath);
+            const targetPathExactStat = fsSync.lstatSync(targetPath, { bigint: true });
             const copiedBack = await hashFileHandle(target, native);
             const sourceAfter = await hashFileHandle(source, native);
             if (targetPathStat.isSymbolicLink() ||

package/dist/replace-file-copy-fallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-file-copy-fallback.d.ts","sourceRoot":"","sources":["../src/replace-file-copy-fallback.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAc,MAAM,SAAS,CAAC;AAO/D,MAAM,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,oCAAoC,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAC/E,MAAM,MAAM,+BAA+B,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAC5E,MAAM,MAAM,sCAAsC,GAAG;IACnD,OAAO,EAAE,+BAA+B,CAAC;CAC1C,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,KAAK,EAAE,cAAc,kBAAkB,EAAE,KAAK,CAAC;IAC/C,IAAI,EAAE,cAAc,kBAAkB,EAAE,IAAI,CAAC;IAC7C,EAAE,EAAE,cAAc,kBAAkB,EAAE,EAAE,CAAC;IACzC,MAAM,EAAE,cAAc,kBAAkB,EAAE,MAAM,CAAC;CAClD,CAAC;AAEF,KAAK,cAAc,GAAG,IAAI,CACxB,OAAO,MAAM,EACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,eAAe,GACf,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,YAAY,GACZ,WAAW,CACd,CAAC;AAuFF,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,IAAI,CAwBN;AAmID,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,CAAC;IACrC,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CAwDhB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,CAAC;IACrC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,IAAI,CAkEP"}
+{"version":3,"file":"replace-file-copy-fallback.d.ts","sourceRoot":"","sources":["../src/replace-file-copy-fallback.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAc,MAAM,SAAS,CAAC;AAO/D,MAAM,MAAM,oCAAoC,GAAG,QAAQ,CAAC;AAC5D,MAAM,MAAM,oCAAoC,GAAG,kBAAkB,GAAG,MAAM,CAAC;AAC/E,MAAM,MAAM,+BAA+B,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAC5E,MAAM,MAAM,sCAAsC,GAAG;IACnD,OAAO,EAAE,+BAA+B,CAAC;CAC1C,CAAC;AAEF,KAAK,eAAe,GAAG;IACrB,KAAK,EAAE,cAAc,kBAAkB,EAAE,KAAK,CAAC;IAC/C,IAAI,EAAE,cAAc,kBAAkB,EAAE,IAAI,CAAC;IAC7C,EAAE,EAAE,cAAc,kBAAkB,EAAE,EAAE,CAAC;IACzC,MAAM,EAAE,cAAc,kBAAkB,EAAE,MAAM,CAAC;CAClD,CAAC;AAEF,KAAK,cAAc,GAAG,IAAI,CACxB,OAAO,MAAM,EACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,eAAe,GACf,WAAW,GACX,UAAU,GACV,UAAU,GACV,QAAQ,GACR,YAAY,GACZ,WAAW,CACd,CAAC;AA0FF,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,oCAAoC,GAC5C,IAAI,CAwBN;AAoID,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,CAAC;IACrC,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DhB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,oCAAoC,CAAC;IAC5D,OAAO,EAAE,oCAAoC,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sBAAsB,CAAC,EAAE,WAAW,CAAC;IACrC,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,IAAI,EAAE,OAAO,CAAC;CACf,GAAG,IAAI,CAkEP"}

package/dist/replace-file-copy-fallback.js

@@ -1,4 +1,5 @@
 import syncFs, {} from "node:fs";
+import fs, {} from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { readOwnedCopySource, readOwnedCopySourceSync } from "./replace-file-copy-source.js";
@@ -27,11 +28,15 @@ function assertPinnedDestination(pathname, opened, dest, hardlinks) {
     }
 }
 async function openPinnedDestination(fsModule, dest, hardlinks) {
-    const preview = await fsModule.lstat(dest).catch((error) => {
+    let preview;
+    try {
+        preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
+    }
+    catch (error) {
         if (notFound(error))
             return null;
         throw error;
-    });
+    }
     if (!preview)
         return null;
     if (preview.isSymbolicLink()) {
@@ -39,8 +44,8 @@ async function openPinnedDestination(fsModule, dest, hardlinks) {
     }
     const handle = await fsModule.open(dest, OPEN_READ_WRITE_FLAGS);
     try {
-        const opened = await handle.stat();
-        const current = await fsModule.lstat(dest);
+        const opened = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
+        const current = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
         assertPinnedDestination(current, opened, dest, hardlinks);
         return { handle, stat: opened };
     }
@@ -76,17 +81,21 @@ function openPinnedDestinationSync(fsModule, dest, hardlinks) {
 export async function assertDestinationHardlinkPolicy(fsModule, dest, policy) {
     if (policy !== "reject")
         return;
-    const preview = await fsModule.lstat(dest).catch((error) => {
+    let preview;
+    try {
+        preview = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
+    }
+    catch (error) {
         if (notFound(error))
-            return null;
+            return;
         throw error;
-    });
+    }
     if (!preview || preview.isSymbolicLink() || !preview.isFile())
         return;
     const handle = await fsModule.open(dest, OPEN_READ_FLAGS);
     try {
-        const opened = await handle.stat();
-        const current = await fsModule.lstat(dest);
+        const opened = fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
+        const current = fsModule === fs ? syncFs.lstatSync(dest) : await fsModule.lstat(dest);
         if (current.isSymbolicLink() || !current.isFile() || !sameFileIdentity(current, opened)) {
             throw new FsSafeError("path-mismatch", `Atomic replace destination changed while opening: ${dest}`);
         }
@@ -191,8 +200,8 @@ function restoreFailure(writeError, cleanup, restoreError) {
         ? `Atomic copy fallback failed; original destination restored: ${primary.message}`
         : `Atomic copy fallback failed and original restoration failed: ${primary.message}`, { cause, details });
 }
-async function replacePinnedWithRestore(handle, replacement, maxRestoreBytes, replacementMode) {
-    const originalMode = (await handle.stat()).mode;
+async function replacePinnedWithRestore(fsModule, handle, replacement, maxRestoreBytes, replacementMode) {
+    const originalMode = (fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat()).mode;
     const original = await readBounded(handle, maxRestoreBytes);
     try {
         await writeAll(handle, replacement);
@@ -250,15 +259,19 @@ export async function copyFallbackReplace(params) {
             const pinned = await openPinnedDestination(params.fsModule, params.dest, params.destinationHardlinks);
             if (pinned) {
                 destHandle = pinned.handle;
-                await replacePinnedWithRestore(destHandle, replacement, params.maxRestoreBytes, source.mode);
+                await replacePinnedWithRestore(params.fsModule, destHandle, replacement, params.maxRestoreBytes, source.mode);
             }
         }
         if (!destHandle) {
-            const destStat = await params.fsModule.lstat(params.dest).catch((error) => {
-                if (notFound(error))
-                    return null;
-                throw error;
-            });
+            let destStat = null;
+            try {
+                destStat = params.fsModule === fs
+                    ? syncFs.lstatSync(params.dest) : await params.fsModule.lstat(params.dest);
+            }
+            catch (error) {
+                if (!notFound(error))
+                    throw error;
+            }
             if (destStat?.isSymbolicLink()) {
                 throw new FsSafeError("symlink", `Refusing copy fallback through symlink destination: ${params.dest}`);
             }

package/dist/replace-file-copy-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-file-copy-source.d.ts","sourceRoot":"","sources":["../src/replace-file-copy-source.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAOnD,KAAK,qBAAqB,GAAG,IAAI,CAAC,cAAc,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;AACvF,KAAK,oBAAoB,GAAG,IAAI,CAC9B,OAAO,MAAM,EACb,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAClE,CAAC;AA0DF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,qBAAqB,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjD;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA8BxC"}
+{"version":3,"file":"replace-file-copy-source.d.ts","sourceRoot":"","sources":["../src/replace-file-copy-source.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAOnD,KAAK,qBAAqB,GAAG,IAAI,CAAC,cAAc,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;AACvF,KAAK,oBAAoB,GAAG,IAAI,CAC9B,OAAO,MAAM,EACb,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAClE,CAAC;AA0DF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,qBAAqB,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BjD;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,CAAC,EAAE,WAAW,CAAC;CAChC,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA8BxC"}

package/dist/replace-file-copy-source.js

@@ -1,4 +1,5 @@
 import syncFs, {} from "node:fs";
+import fs, {} from "node:fs/promises";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { FsSafeError } from "./errors.js";
 import { sameFileIdentity } from "./file-identity.js";
@@ -57,15 +58,19 @@ function readAllSync(fsModule, fd) {
     return Buffer.concat(chunks, position);
 }
 export async function readOwnedCopySource(params) {
-    assertSourcePreview(await params.fsModule.lstat(params.src), params.src);
+    assertSourcePreview(params.fsModule === fs
+        ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src), params.src);
     const handle = await openSource(params.fsModule, params.src);
     try {
         if (params.expectedIdentity) {
-            const exact = await inspectFileIdentity(() => handle.stat({ bigint: true }), params.expectedIdentity);
-            await inspectFileIdentity(() => params.fsModule.lstat(params.src, { bigint: true }), exact);
+            const exact = await inspectFileIdentity(() => params.fsModule === fs
+                ? syncFs.fstatSync(handle.fd, { bigint: true }) : handle.stat({ bigint: true }), params.expectedIdentity);
+            await inspectFileIdentity(() => params.fsModule === fs
+                ? syncFs.lstatSync(params.src, { bigint: true }) : params.fsModule.lstat(params.src, { bigint: true }), exact);
         }
-        const opened = await handle.stat();
-        const current = await params.fsModule.lstat(params.src);
+        const opened = params.fsModule === fs ? syncFs.fstatSync(handle.fd) : await handle.stat();
+        const current = params.fsModule === fs
+            ? syncFs.lstatSync(params.src) : await params.fsModule.lstat(params.src);
         if (!opened.isFile() || current.isSymbolicLink() || !sameFileIdentity(opened, current)) {
             throw new FsSafeError("path-mismatch", `Copy fallback source changed while opening: ${params.src}`);
         }

package/dist/replace-file-temp-owner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-file-temp-owner.d.ts","sourceRoot":"","sources":["../src/replace-file-temp-owner.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAA6B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAO9F,KAAK,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;AACzE,KAAK,mBAAmB,GAAG,IAAI,CAC7B,OAAO,MAAM,EACb,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CACrF,CAAC;AAgEF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,sBAAsB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AA+BD,qBAAa,oBAAoB;;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,KAAK,IAAI,IAAI,CAEZ;IAED,QAAQ,CAAC,UAAU,aAAc,WAAW,KAAG,IAAI,CAGjD;IAEF,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAG/D;IAED,IAAI,QAAQ,IAAI,WAAW,CAG1B;IAEK,aAAa,CAAC,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,SAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3F;IAEK,eAAe,CACnB,QAAQ,EAAE,oBAAoB,EAC9B,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Cf;IAED,WAAW,IAAI,IAAI,CAGlB;IAEK,MAAM,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,oBAAoB,CAAC;QAC/B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC;KAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;CACF;AAED,qBAAa,mBAAmB;;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,KAAK,IAAI,IAAI,CAEZ;IAED,QAAQ,CAAC,UAAU,aAAc,WAAW,KAAG,IAAI,CAGjD;IAEF,KAAK,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAGvD;IAED,IAAI,QAAQ,IAAI,WAAW,CAG1B;IAED,aAAa,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,SAAgB,GAAG,IAAI,CAkB3E;IAED,eAAe,CACb,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CAgDN;IAED,WAAW,IAAI,IAAI,CAGlB;IAED,MAAM,CAAC,MAAM,EAAE;QACb,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC;KAC9B,GAAG,IAAI,CAgCP;CACF"}
+{"version":3,"file":"replace-file-temp-owner.d.ts","sourceRoot":"","sources":["../src/replace-file-temp-owner.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,EAAE,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAA6B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAO9F,KAAK,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;AACzE,KAAK,mBAAmB,GAAG,IAAI,CAC7B,OAAO,MAAM,EACb,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,cAAc,GAAG,YAAY,CACrF,CAAC;AAgEF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,sBAAsB,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AA+BD,qBAAa,oBAAoB;;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,KAAK,IAAI,IAAI,CAEZ;IAED,QAAQ,CAAC,UAAU,aAAc,WAAW,KAAG,IAAI,CAGjD;IAEF,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,QAAQ,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAG/D;IAED,IAAI,QAAQ,IAAI,WAAW,CAG1B;IAEK,aAAa,CAAC,QAAQ,EAAE,oBAAoB,EAAE,QAAQ,SAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB3F;IAEK,eAAe,CACnB,QAAQ,EAAE,oBAAoB,EAC9B,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CA4Cf;IAED,WAAW,IAAI,IAAI,CAGlB;IAEK,MAAM,CAAC,MAAM,EAAE;QACnB,QAAQ,EAAE,oBAAoB,CAAC;QAC/B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC;KAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BhB;CACF;AAED,qBAAa,mBAAmB;;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAM1B,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,KAAK,IAAI,IAAI,CAEZ;IAED,QAAQ,CAAC,UAAU,aAAc,WAAW,KAAG,IAAI,CAGjD;IAEF,KAAK,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,WAAW,CAAA;KAAE,GAAG,IAAI,CAGvD;IAED,IAAI,QAAQ,IAAI,WAAW,CAG1B;IAED,aAAa,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,SAAgB,GAAG,IAAI,CAkB3E;IAED,eAAe,CACb,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CAkDN;IAED,WAAW,IAAI,IAAI,CAGlB;IAED,MAAM,CAAC,MAAM,EAAE;QACb,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC;KAC9B,GAAG,IAAI,CAkCP;CACF"}