@openclaw/fs-safe 0.9.0 → 0.11.0

package/dist/native-pinned-write-windows.js

@@ -1,9 +1,11 @@
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { randomUUID } from "node:crypto";
 import fsSync, {} from "node:fs";
+import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { nativeOpenFlags, removeNativeCreatedFileIfStillPinned, writeNativeInput, } from "./native-operations.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 export function sameNativeIdentity(left, right) {
     return left.dev === right.dev && left.ino === right.ino;
 }
@@ -27,6 +29,7 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
     let completed = false;
     try {
         tempName = `.fs-safe-${randomUUID()}.tmp`;
+        params.assertBeforeMutation?.();
         tempFd = binding.openBeneath(parentFd, tempName, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL)).fd;
         const verificationIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(tempFd, { bigint: true }));
         tempIdentity = verificationIdentity;
@@ -34,9 +37,13 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
         // can remove owner access. Keep the unpublished inode private and
         // reopenable until the published name has been identity-fenced.
         fsSync.fchmodSync(tempFd, 0o600);
-        await writeNativeInput(tempFd, params.input, params.maxBytes);
+        await writeNativeInput(tempFd, params.input, params.maxBytes, params.assertBeforeMutation);
         if (params.sync !== false)
             syncFileBestEffortSync(tempFd);
+        if (params.input.kind === "file")
+            await params.input.verifySource();
+        assertFinalSymlinkRejected(path.join(parentPath, params.basename), params.rejectFinalSymlink);
+        params.assertBeforeMutation?.();
         if (params.overwrite === false) {
             binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
         }
@@ -44,6 +51,7 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
             binding.renameReplace(parentFd, tempName, parentFd, params.basename);
         }
         renamed = true;
+        params.onPublished?.(verificationIdentity);
         targetFd = binding.openBeneath(parentFd, params.basename, nativeOpenFlags(fsSync.constants.O_RDONLY)).fd;
         const targetStat = inspectFileIdentitySync(() => fsSync.fstatSync(targetFd, { bigint: true }), verificationIdentity);
         const targetIdentity = binding.fstatIdentity(targetFd);
@@ -61,12 +69,16 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
         catch (error) {
             closeWriteFd(targetFd);
             targetFd = undefined;
-            removeNativeCreatedFileIfStillPinned({
-                parentPath,
-                parentFd,
-                basename: params.basename,
-                created: tempIdentity,
-            });
+            // Staged copies and streamed creates preserve publication for caller recovery.
+            if (params.input.kind === "buffer" ||
+                (params.input.kind === "stream" && !params.input.stageBeforePublish)) {
+                removeNativeCreatedFileIfStillPinned({
+                    parentPath,
+                    parentFd,
+                    basename: params.basename,
+                    created: tempIdentity,
+                });
+            }
             throw error;
         }
         if (params.sync !== false)

package/dist/native-pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAI3D,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0FvH"}
+{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAK3D,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2FvH"}

package/dist/native-pinned-write.js

@@ -59,6 +59,7 @@ import { runPinnedWriteWindows, sameNativeIdentity } from "./native-pinned-write
 import { assertNativeStaging, writeNativeStage } from "./native-staged-file.js";
 import { describeStagedDirectory, exactIdentityMatches } from "./staged-directory.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { realpathSync } from "./realpath.js";
 export async function runPinnedWriteNative(binding, params) {
     const env_1 = { stack: [], error: void 0, hasError: false };
     try {
@@ -100,10 +101,11 @@ export async function runPinnedWriteNative(binding, params) {
                 throw new FsSafeError("path-mismatch", "root path changed during native write");
             }
             if (params.mkdir) {
+                params.assertBeforeMutation?.();
                 binding.mkdirBeneath(root.fd, params.relativeParentPath, 0o777);
             }
             parentFd = binding.openBeneath(root.fd, params.relativeParentPath, directoryFlags).fd;
-            const parentPath = fsSync.realpathSync.native(params.relativeParentPath
+            const parentPath = realpathSync.native(params.relativeParentPath
                 ? path.join(params.rootPath, ...params.relativeParentPath.split("/"))
                 : params.rootPath);
             const directory = windows ? undefined : describeStagedDirectory(parentFd, parentPath);

package/dist/native-staged-file.d.ts

@@ -8,14 +8,14 @@ export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding,
 export declare function assertNativeStaging(binding: NativeBinding): asserts binding is NativeStagingBinding;
 declare class NativeStagedFile implements StagedFile {
     #private;
-    constructor(binding: NativeStagingBinding, parentFd: number, directory: StagedFileReceipt["directory"], portableNames: boolean, publishedMode: number, sync: boolean);
-    static create(binding: NativeStagingBinding, parentFd: number, directory: StagedFileReceipt["directory"], input: PinnedWriteInput, mode: number, maxBytes?: number, portableNames?: boolean, sync?: boolean): Promise<NativeStagedFile>;
+    constructor(binding: NativeStagingBinding, parentFd: number, directory: StagedFileReceipt["directory"], portableNames: boolean, publishedMode: number, sync: boolean, assertBeforeMutation?: () => void);
+    static create(binding: NativeStagingBinding, parentFd: number, directory: StagedFileReceipt["directory"], input: PinnedWriteInput, mode: number, maxBytes?: number, portableNames?: boolean, sync?: boolean, assertBeforeMutation?: () => void): Promise<NativeStagedFile>;
     static write(binding: NativeStagingBinding, parentFd: number, directory: StagedFileReceipt["directory"], params: PinnedWriteParams, parentGuard: AnyAsyncDirectoryGuard): Promise<FileIdentityStat>;
     get receipt(): StagedFileReceipt;
     assertCurrent(): Promise<void>;
     publish(basename: string, options: {
         overwrite: boolean;
-    }): Promise<PublishedFileReceipt>;
+    }, onPublished?: PinnedWriteParams["onPublished"]): Promise<PublishedFileReceipt>;
     cleanup(): Promise<StagedFileCleanupReceipt>;
     [Symbol.asyncDispose](): Promise<void>;
 }

package/dist/native-staged-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-staged-file.d.ts","sourceRoot":"","sources":["../src/native-staged-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAKlE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EAGxB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,QAAQ,CAAC,IAAI,CAC9D,aAAa,EACb,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,CAC9D,CAAC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAUnG;AA6BD,cAAM,gBAAiB,YAAW,UAAU;;IAW1C,YACE,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EAQd;IAGD,OAAa,MAAM,CACjB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EAEjB,aAAa,UAAO,EACpB,IAAI,UAAO,GACV,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,OAAa,KAAK,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAU3B;IAED,IAAI,OAAO,IAAI,iBAAiB,CAK/B;IAoFK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnC;IAEK,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAqD9F;IA6CK,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAMjD;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3C;CACF;AAED,eAAO,MAAM,iBAAiB,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,UAAU,CAClF,CAAC;AAC1B,eAAO,MAAM,gBAAgB,+BAAyB,CAAC;AAEvD,YAAY,EACV,oBAAoB,EAAE,UAAU,EAAE,wBAAwB,EAAE,wBAAwB,EACpF,qBAAqB,EAAE,iBAAiB,GACzC,MAAM,wBAAwB,CAAC;AAEhC,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACrC,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtB"}
+{"version":3,"file":"native-staged-file.d.ts","sourceRoot":"","sources":["../src/native-staged-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EAGxB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,QAAQ,CAAC,IAAI,CAC9D,aAAa,EACb,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,CAC9D,CAAC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAUnG;AA6BD,cAAM,gBAAiB,YAAW,UAAU;;IAa1C,YACE,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,oBAAoB,CAAC,EAAE,MAAM,IAAI,EASlC;IAGD,OAAa,MAAM,CACjB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EAEjB,aAAa,UAAO,EACpB,IAAI,UAAO,EACX,oBAAoB,CAAC,EAAE,MAAM,IAAI,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,OAAa,KAAK,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,IAAI,OAAO,IAAI,iBAAiB,CAK/B;IA8FK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnC;IAEK,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,EAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAC7C,OAAO,CAAC,oBAAoB,CAAC,CAyD/B;IA6CK,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAMjD;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3C;CACF;AAED,eAAO,MAAM,iBAAiB,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,UAAU,CAClF,CAAC;AAC1B,eAAO,MAAM,gBAAgB,+BAAyB,CAAC;AAEvD,YAAY,EACV,oBAAoB,EAAE,UAAU,EAAE,wBAAwB,EAAE,wBAAwB,EACpF,qBAAqB,EAAE,iBAAiB,GACzC,MAAM,wBAAwB,CAAC;AAEhC,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACrC,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtB"}

package/dist/native-staged-file.js

@@ -54,9 +54,13 @@ import { requireNativeBinding } from "./native.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
+import path from "node:path";
 import { FsSafeError } from "./errors.js";
+import { MutationAuthorityError } from "./mutation-authority.js";
 import { writeNativeInput } from "./native-operations.js";
+import { assertNativeCopyCompleted, createNativeCopyFile } from "./copy-file-input.js";
 import { assertStagedDirectoryCurrent, openStagedDirectory } from "./staged-directory.js";
+import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
 export function assertNativeStaging(binding) {
     if ([
         binding.createStagedFile,
@@ -93,24 +97,27 @@ class NativeStagedFile {
     #portableNames;
     #publishedMode;
     #sync;
+    #assertBeforeMutation;
     #name = `.fs-safe-${randomUUID()}.tmp`;
     #state = { status: "open", publication: NOT_PUBLISHED };
     #receipt;
-    constructor(binding, parentFd, directory, portableNames, publishedMode, sync) {
+    #rejectFinalSymlink = false;
+    constructor(binding, parentFd, directory, portableNames, publishedMode, sync, assertBeforeMutation) {
         this.#binding = binding;
         this.#parentFd = parentFd;
         this.#directory = directory;
         this.#portableNames = portableNames;
         this.#publishedMode = publishedMode;
         this.#sync = sync;
+        this.#assertBeforeMutation = assertBeforeMutation;
     }
     // Takes ownership of parentFd, including all construction and preparation failures.
     static async create(binding, parentFd, directory, input, mode, maxBytes, 
     // Public staging uses portable names; existing POSIX writes accept literal names.
-    portableNames = true, sync = true) {
+    portableNames = true, sync = true, assertBeforeMutation) {
         let staged;
         try {
-            staged = new NativeStagedFile(binding, parentFd, directory, portableNames, mode, sync);
+            staged = new NativeStagedFile(binding, parentFd, directory, portableNames, mode, sync, assertBeforeMutation);
         }
         catch (error) {
             try {
@@ -129,8 +136,11 @@ class NativeStagedFile {
         try {
             // This owner never escapes. Only the internal verifier borrows its fd;
             // public descriptor methods remain await-free and cannot race disposal.
-            const staged = __addDisposableResource(env_1, await NativeStagedFile.create(binding, parentFd, directory, params.input, params.mode, params.maxBytes, false, params.sync), true);
-            const published = await staged.publish(params.basename, { overwrite: params.overwrite !== false });
+            const staged = __addDisposableResource(env_1, await NativeStagedFile.create(binding, parentFd, directory, params.input, params.mode, params.maxBytes, false, params.sync, params.assertBeforeMutation), true);
+            staged.#rejectFinalSymlink = params.rejectFinalSymlink === true;
+            if (params.input.kind === "file")
+                await params.input.verifySource();
+            const published = await staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
             const identity = published.staged.identity;
             await params.verifyPublished?.(staged.#file(), identity, parentGuard);
             return { dev: identity.dev, ino: identity.ino };
@@ -190,10 +200,22 @@ class NativeStagedFile {
             // The exclusive open performs no fallible post-open checks. Store its fd
             // before every subsequent operation, including the first metadata read.
             const state = this.#open();
-            state.fileFd = this.#binding.createStagedFile(this.#parentFd, this.#name);
+            this.#assertBeforeMutation?.();
+            const copied = input.kind === "file"
+                ? await createNativeCopyFile(this.#binding, input, this.#parentFd, this.#name, maxBytes, false)
+                : undefined;
+            state.fileFd = copied?.fd;
+            if (state.fileFd === undefined) {
+                this.#assertBeforeMutation?.();
+                state.fileFd = this.#binding.createStagedFile(this.#parentFd, this.#name);
+            }
             const fd = state.fileFd;
+            if (input.kind === "file")
+                assertNativeCopyCompleted(input, copied);
+            this.#assertBeforeMutation?.();
             fs.fchmodSync(fd, 0o600);
-            await writeNativeInput(fd, input, maxBytes);
+            if (!copied)
+                await writeNativeInput(fd, input, maxBytes, this.#assertBeforeMutation);
             if (this.#sync)
                 syncFileBestEffortSync(fd);
             const stat = fs.fstatSync(fd, { bigint: true });
@@ -230,7 +252,7 @@ class NativeStagedFile {
     async assertCurrent() {
         this.#assertCurrent();
     }
-    async publish(basename, options) {
+    async publish(basename, options, onPublished) {
         const overwrite = options?.overwrite;
         try {
             const state = this.#open();
@@ -239,6 +261,8 @@ class NativeStagedFile {
                 throw new FsSafeError("invalid-path", "publication needs a distinct basename and explicit overwrite policy");
             }
             this.#assertCurrent();
+            assertFinalSymlinkRejected(path.join(this.#directory.realPath, basename), this.#rejectFinalSymlink);
+            this.#assertBeforeMutation?.();
             try {
                 if (overwrite) {
                     this.#binding.renameReplace(this.#parentFd, this.#name, this.#parentFd, basename);
@@ -262,6 +286,7 @@ class NativeStagedFile {
                 overwrite,
             });
             state.publication = receipt;
+            onPublished?.(receipt.staged.identity);
             const stagedMode = this.#assertNamed(basename);
             assertStagedDirectoryCurrent(this.#directory);
             // Keep contents private until the published name passes its identity
@@ -282,6 +307,8 @@ class NativeStagedFile {
             return receipt;
         }
         catch (error) {
+            if (error instanceof MutationAuthorityError)
+                throw error;
             // Closure rejects further use, not the recorded outcome of an earlier publication.
             const publication = this.#state.status === "closed"
                 ? this.#state.receipt.publication

package/dist/opened-realpath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}
+{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}

package/dist/opened-realpath.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { openedPathResolutionError } from "./opened-file-failure.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { isNotFoundPathError } from "./path.js";
+import { realpathSync } from "./realpath.js";
 export async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
     const handleStat = fsSync.fstatSync(handle.fd);
     return (await resolveOpenedFileRealPathForFd(handle.fd, handleStat, ioPath)).realPath;
@@ -16,7 +17,7 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
         : [];
     for (const fdPath of fdCandidates) {
         try {
-            const fdRealPath = fsSync.realpathSync.native(fdPath);
+            const fdRealPath = realpathSync.native(fdPath);
             const fdRealStat = statOptions ? fsSync.statSync(fdRealPath, statOptions) : fsSync.statSync(fdRealPath);
             if (sameFileIdentity(handleStat, fdRealStat)) {
                 return { realPath: fdRealPath, stat: fdRealStat };
@@ -27,7 +28,7 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
         }
     }
     try {
-        const ioRealPath = fsSync.realpathSync.native(ioPath);
+        const ioRealPath = realpathSync.native(ioPath);
         const ioRealStat = statOptions ? fsSync.statSync(ioRealPath, statOptions) : fsSync.statSync(ioRealPath);
         if (sameFileIdentity(handleStat, ioRealStat)) {
             return { realPath: ioRealPath, stat: ioRealStat };
@@ -53,7 +54,7 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
 async function resolveOpenedFileRealPathFromParent(handleStat, ioPath, statOptions) {
     let parentReal;
     try {
-        parentReal = fsSync.realpathSync.native(path.dirname(ioPath));
+        parentReal = realpathSync.native(path.dirname(ioPath));
     }
     catch (err) {
         if (isNotFoundPathError(err)) {
@@ -76,7 +77,7 @@ async function resolveOpenedFileRealPathFromParent(handleStat, ioPath, statOptio
         try {
             const candidateStat = statOptions ? fsSync.lstatSync(candidatePath, statOptions) : fsSync.lstatSync(candidatePath);
             if (candidateStat.isFile() && sameFileIdentity(handleStat, candidateStat)) {
-                const realPath = fsSync.realpathSync.native(candidatePath);
+                const realPath = realpathSync.native(candidatePath);
                 const stat = statOptions ? fsSync.statSync(realPath, statOptions) : fsSync.statSync(realPath);
                 if (sameFileIdentity(handleStat, stat))
                     return { realPath, stat };

package/dist/output.d.ts

@@ -5,6 +5,8 @@ export type ExternalFileWriteOptions<T = void> = {
     maxBytes?: number;
     mode?: number;
     staging?: "workspace" | "sibling";
+    /** Isolate sibling producers; workspace staging is already private. */
+    producerIsolation?: "private-directory";
     fallbackFileName?: string;
 };
 export type ExternalFileWriteResult<T = void> = {

package/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AAyDF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAgDrC"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAClC,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AAyDF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAiDrC"}

package/dist/output.js

@@ -74,6 +74,7 @@ export async function writeExternalFileWithinRoot(options) {
         const result = await writeExternalFileViaSibling({
             finalPath: siblingFinalPath,
             write: options.write,
+            producerIsolation: options.producerIsolation,
             fallbackFileName: options.fallbackFileName,
             maxBytes,
             mode: options.mode,
@@ -113,6 +114,7 @@ async function writeExternalFileViaSibling(params) {
     const { result } = await writeCallbackSibling({
         tempPath: buildSiblingTempPath(finalPath, params.fallbackFileName),
         write: params.write,
+        producerIsolation: params.producerIsolation,
         resolveFinalPath: () => finalPath,
         mode: params.mode,
         maxBytes: params.maxBytes,

package/dist/overwrite-file-handle.d.ts

@@ -0,0 +1,8 @@
+import type { FileHandle } from "node:fs/promises";
+export type OverwriteFileHandleOptions = {
+    /** Admit the whole write once, after rollback preparation and before any mutation. */
+    beforeWrite?: () => void;
+};
+/** Overwrite a borrowed, non-append read/write handle with best-effort failure rollback. */
+export declare function overwriteFileHandle(handle: FileHandle, data: Uint8Array, options?: OverwriteFileHandleOptions): Promise<void>;
+//# sourceMappingURL=overwrite-file-handle.d.ts.map

package/dist/overwrite-file-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overwrite-file-handle.d.ts","sourceRoot":"","sources":["../src/overwrite-file-handle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,MAAM,MAAM,0BAA0B,GAAG;IACvC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/dist/overwrite-file-handle.js

@@ -0,0 +1,42 @@
+import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult } from "./mutation-authority.js";
+import { readFileWindowFully } from "./positional-read.js";
+import { writeAllToFile } from "./write-file-handle.js";
+/** Overwrite a borrowed, non-append read/write handle with best-effort failure rollback. */
+export async function overwriteFileHandle(handle, data, options = {}) {
+    const payload = data.subarray(0, data.byteLength);
+    const payloadBytes = payload.byteLength;
+    const stat = await handle.stat();
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "overwrite handle must be a regular file");
+    }
+    const originalSize = stat.size;
+    if (!Number.isSafeInteger(originalSize) || originalSize < 0) {
+        throw new RangeError("file size must be a non-negative safe integer");
+    }
+    const prefixBytes = Math.min(payloadBytes, originalSize);
+    const originalPrefix = Buffer.allocUnsafe(prefixBytes);
+    if (await readFileWindowFully(handle, originalPrefix, 0) !== prefixBytes) {
+        throw new FsSafeError("read-failed", "file ended before overwrite rollback preparation completed");
+    }
+    assertSynchronousCallbackResult(options.beforeWrite?.(), "beforeWrite");
+    let prefixStarted = false;
+    try {
+        // Leave existing bytes intact until any additional storage has been written.
+        if (payloadBytes > originalSize) {
+            await writeAllToFile(handle, payload.subarray(originalSize), { position: originalSize });
+        }
+        prefixStarted = true;
+        await writeAllToFile(handle, payload.subarray(0, prefixBytes), { position: 0 });
+        if (payloadBytes < originalSize) {
+            await handle.truncate(payloadBytes);
+        }
+    }
+    catch (error) {
+        if (prefixStarted) {
+            await writeAllToFile(handle, originalPrefix, { position: 0 }).catch(() => undefined);
+        }
+        await handle.truncate(originalSize).catch(() => undefined);
+        throw error;
+    }
+}

package/dist/path-case.d.ts

@@ -0,0 +1,7 @@
+export type ProbePathCaseOptions = {
+    /** Allow an exclusively created empty probe when existing entries provide no answer. Defaults to true. */
+    allowTemporaryProbe?: boolean;
+};
+/** Observe local ASCII case behavior; unknown observations never imply an operating-system default. */
+export declare function probePathCaseInsensitiveSync(targetPath: string, options?: ProbePathCaseOptions): boolean | undefined;
+//# sourceMappingURL=path-case.d.ts.map

package/dist/path-case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-case.d.ts","sourceRoot":"","sources":["../src/path-case.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,oBAAoB,GAAG;IACjC,0GAA0G;IAC1G,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAmFF,uGAAuG;AACvG,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,GAAG,SAAS,CAqCrB"}

package/dist/path-case.js

@@ -0,0 +1,136 @@
+import { randomUUID } from "node:crypto";
+import fs, {} from "node:fs";
+import path from "node:path";
+import { assertDirectoryIdentitySync, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { isNotFoundPathError } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { writeTempFileSync } from "./replace-file-descriptor.js";
+import { SyncAtomicTempOwner } from "./replace-file-temp-owner.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+function swapAsciiCase(value) {
+    return value.replace(/[A-Za-z]/g, character => {
+        const lower = character.toLowerCase();
+        return character === lower ? character.toUpperCase() : lower;
+    });
+}
+function probeEntry(directory, name, names) {
+    const alternate = swapAsciiCase(name);
+    if (alternate === name)
+        return undefined;
+    const bothListed = names.has(name) && names.has(alternate);
+    const originalPath = path.join(directory, name);
+    let original;
+    let observed;
+    try {
+        original = inspectFileIdentitySync(() => fs.lstatSync(originalPath, { bigint: true }));
+        try {
+            const other = inspectFileIdentitySync(() => fs.lstatSync(path.join(directory, alternate), { bigint: true }));
+            const sameIdentity = sameFileIdentityForCleanup(original, other);
+            if (sameIdentity || bothListed) {
+                // Matching inodes can belong to newly linked case-distinct names.
+                const currentNames = new Set(fs.readdirSync(directory));
+                const bothCurrent = currentNames.has(name) && currentNames.has(alternate);
+                if (bothListed && !bothCurrent)
+                    return undefined;
+                observed = sameIdentity && !bothCurrent;
+            }
+            else {
+                observed = false;
+            }
+        }
+        catch (error) {
+            if (bothListed || !isNotFoundPathError(error))
+                return undefined;
+            observed = false;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    // Disappearance during lookup is not evidence that case variants are distinct.
+    inspectFileIdentitySync(() => fs.lstatSync(originalPath, { bigint: true }), original);
+    return observed;
+}
+function probeTemporaryEntry(directory) {
+    const name = `.fs-safe-case-probe-${randomUUID()}`;
+    const owner = new SyncAtomicTempOwner(path.join(directory, name));
+    try {
+        owner.start();
+        owner.adopt(writeTempFileSync({
+            fsModule: fs,
+            tempPath: owner.pathname,
+            content: "",
+            mode: 0o600,
+            sync: false,
+            onIdentity: owner.onIdentity,
+        }));
+        owner.assertCurrent(fs);
+        const observed = probeEntry(directory, name, new Set(fs.readdirSync(directory)));
+        owner.assertCurrent(fs);
+        return observed;
+    }
+    finally {
+        // Failed cleanup invalidates the observation; the existing owner retains its exit retry.
+        owner.finish({ fsModule: fs, throwOnCleanupError: true });
+    }
+}
+function probeDirectory(directory, allowTemporaryProbe, preferredName) {
+    const canonical = realpathSync.native(directory);
+    const identity = inspectDirectoryIdentitySync(canonical);
+    const names = new Set(fs.readdirSync(canonical));
+    let observed = preferredName === undefined ? undefined : probeEntry(canonical, preferredName, names);
+    for (const name of names) {
+        if (observed !== undefined)
+            break;
+        observed = probeEntry(canonical, name, names);
+    }
+    if (observed === undefined && allowTemporaryProbe)
+        observed = probeTemporaryEntry(canonical);
+    assertDirectoryIdentitySync(canonical, identity);
+    return realpathSync.native(directory) === canonical ? observed : undefined;
+}
+/** Observe local ASCII case behavior; unknown observations never imply an operating-system default. */
+export function probePathCaseInsensitiveSync(targetPath, options = {}) {
+    const resolved = path.resolve(targetPath);
+    const allowTemporaryProbe = options.allowTemporaryProbe !== false;
+    let targetExists = true;
+    try {
+        fs.lstatSync(resolved);
+    }
+    catch (error) {
+        if (!isNotFoundPathError(error))
+            return undefined;
+        targetExists = false;
+    }
+    if (targetExists) {
+        try {
+            return probeDirectory(path.dirname(resolved), allowTemporaryProbe, path.basename(resolved));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    let directory = path.dirname(resolved);
+    for (;;) {
+        let exists = false;
+        try {
+            exists = fs.statSync(directory).isDirectory();
+        }
+        catch {
+            // A missing or unreadable component can still have a readable existing ancestor.
+        }
+        if (exists) {
+            try {
+                return probeDirectory(directory, allowTemporaryProbe);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            return undefined;
+        directory = parent;
+    }
+}

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAMzB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA4BlE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAUT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrF"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA8BlE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAUT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrF"}

package/dist/path.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
+import { realpathSync } from "./realpath.js";
 import { isDriveRelativePath } from "./safe-path-segment.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, } from "./device-path.js";
 const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
@@ -49,7 +50,9 @@ export function isPathInside(root, target) {
         target.charCodeAt(0) === POSIX_SEPARATOR_CHAR_CODE &&
         !target.includes("/..") &&
         (target === root ||
-            (target.startsWith(root) && target.charCodeAt(root.length) === POSIX_SEPARATOR_CHAR_CODE))) {
+            (target.startsWith(root) &&
+                (root.charCodeAt(root.length - 1) === POSIX_SEPARATOR_CHAR_CODE ||
+                    target.charCodeAt(root.length) === POSIX_SEPARATOR_CHAR_CODE)))) {
         return true;
     }
     const resolvedRoot = path.resolve(root);
@@ -74,7 +77,7 @@ export function safeRealpathSync(targetPath, cache) {
         return cached;
     }
     try {
-        const resolved = fs.realpathSync(targetPath);
+        const resolved = realpathSync(targetPath);
         cache?.set(targetPath, resolved);
         cache?.set(resolved, resolved);
         return resolved;

package/dist/permissions-windows.d.ts

@@ -1,5 +1,5 @@
 import { type PermissionCommandFailure } from "./permission-exec.js";
-import type { PermissionCheck, PermissionCheckOptions, SafeStatResult } from "./permissions.js";
+import { type PermissionCheck, type PermissionCheckOptions, type SafeStatResult } from "./permissions.js";
 export type PermissionExec = (command: string, args: string[]) => Promise<{
     stdout: string;
     stderr: string;

package/dist/permissions-windows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-windows.d.ts","sourceRoot":"","sources":["../src/permissions-windows.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAShG,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAyEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,sBAAsB,CAAC;CAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CAmD3B;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAKf;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAgBvF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAYjK;AAED,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCxP;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAKpG;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMzJ"}
+{"version":3,"file":"permissions-windows.d.ts","sourceRoot":"","sources":["../src/permissions-windows.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKpH,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAyEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,sBAAsB,CAAC;CAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CA6C3B;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAKf;AAiED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAgBvF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAgBjK;AAiCD,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCxP;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAKpG;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMzJ"}