@openclaw/fs-safe 0.9.0 → 0.11.0

package/dist/permissions-windows.js

@@ -1,9 +1,10 @@
 import os from "node:os";
 import { getNativeBinding } from "./native.js";
-import { executePermissionCommand, formatPermissionErrorDetail, getPermissionCommandFailure, } from "./permission-exec.js";
+import { executePermissionCommand } from "./permission-exec.js";
+import { safeStat } from "./permissions.js";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
 import { resolveWindowsSystemCommand } from "./windows-command.js";
-import { inspectWindowsOwner, resolveWindowsCurrentUserSid, resolveWindowsPrincipalSids, } from "./windows-owner.js";
+import { inspectWindowsOwner } from "./windows-owner.js";
 const INHERIT_FLAGS = new Set(["I", "OI", "CI", "IO", "NP"]);
 const WORLD_PRINCIPALS = new Set(["everyone", "users", "builtin\\users", "authenticated users", "nt authority\\authenticated users", "anonymous logon", "nt authority\\anonymous logon", "guests", "builtin\\guests", "interactive", "nt authority\\interactive", "network", "nt authority\\network", "local"]);
 const TRUSTED_BASE = new Set([
@@ -92,13 +93,7 @@ export async function inspectWindowsPermissions(params) {
         const error = `Windows owner inspection failed: ${owner.error}`;
         return { ...unverified, ownerError: owner.error, error, errorDetail: owner.errorDetail, errorCause: owner.errorCause };
     }
-    const acl = await inspectWindowsAcl(params.targetPath, {
-        env: params.opts?.env,
-        exec: params.opts?.exec,
-        currentUserSid: owner.currentUserSid,
-        principalSids: owner.principalSids,
-        principalTranslationFailed: owner.principalTranslationFailed,
-    });
+    const acl = summarizeWindowsOwnerAcl(owner);
     const ownerFields = {
         ...(owner.sid ? { ownerSid: owner.sid } : {}),
         ...(owner.trusted !== undefined ? { ownerTrusted: owner.trusted } : {}),
@@ -132,8 +127,18 @@ export function resolveWindowsUserPrincipal(env, userInfo = defaultWindowsUserIn
     const domain = env?.USERDOMAIN?.trim();
     return domain ? `${domain}\\${username}` : username;
 }
+function buildTrustedSidPrincipals(env) {
+    const trusted = new Set();
+    const userSid = normalizeSid(env?.USERSID ?? "");
+    if (userSid && SID_RE.test(userSid) && !WORLD_SIDS.has(userSid))
+        trusted.add(userSid);
+    return trusted;
+}
 function buildTrustedPrincipals(env) {
-    const trusted = new Set(TRUSTED_BASE);
+    const trusted = new Set([
+        ...TRUSTED_BASE,
+        ...buildTrustedSidPrincipals(env),
+    ]);
     const principal = resolveWindowsUserPrincipal(env);
     if (principal) {
         trusted.add(normalize(principal));
@@ -141,9 +146,6 @@ function buildTrustedPrincipals(env) {
         if (userOnly)
             trusted.add(normalize(userOnly));
     }
-    const userSid = normalizeSid(env?.USERSID ?? "");
-    if (userSid && SID_RE.test(userSid) && !WORLD_SIDS.has(userSid))
-        trusted.add(userSid);
     return trusted;
 }
 function classifyPrincipal(principal, trustedPrincipals) {
@@ -215,7 +217,11 @@ export function parseIcaclsOutput(output, targetPath) {
     return entries;
 }
 export function summarizeWindowsAcl(entries, env) {
-    const trustedPrincipals = buildTrustedPrincipals(env);
+    // Canonical SID entries cannot match account names. Classify them directly
+    // so structured descriptor facts do not depend on a separate user lookup.
+    const trustedPrincipals = entries.every((entry) => SID_RE.test(normalize(entry.sid ?? entry.principal)))
+        ? buildTrustedSidPrincipals(env)
+        : buildTrustedPrincipals(env);
     const trusted = [];
     const untrustedWorld = [];
     const untrustedGroup = [];
@@ -230,49 +236,75 @@ export function summarizeWindowsAcl(entries, env) {
     }
     return { trusted, untrustedWorld, untrustedGroup };
 }
-export async function inspectWindowsAcl(targetPath, opts) {
-    let command = "";
-    let startedAt = performance.now();
-    const exec = async (file, args) => {
-        command = file;
-        startedAt = performance.now();
-        return await (opts?.exec ?? defaultPermissionExec)(file, args);
-    };
-    try {
-        if (opts?.principalTranslationFailed)
-            throw new Error("Windows ACL principal SID translation failed");
-        const { stdout, stderr } = await exec(resolveWindowsSystemCommand("icacls.exe", opts?.env), [targetPath]);
-        let entries = parseIcaclsOutput(`${stdout}\n${stderr}`.trim(), targetPath);
-        if (!entries.length)
-            throw new Error("Windows ACL output could not be verified");
-        const unresolvedPrincipals = entries.filter((entry) => !entry.sid).map((entry) => entry.principal);
-        const principalSids = await resolveWindowsPrincipalSids({ principals: unresolvedPrincipals, known: opts?.principalSids, env: opts?.env, exec });
-        entries = entries.map((entry) => {
-            const sid = entry.sid ?? principalSids[entry.principal.toLowerCase()];
-            if (!sid)
-                throw new Error(`Windows ACL principal SID could not be verified: ${entry.principal}`);
-            return { ...entry, sid };
-        });
-        let currentUserSid = normalizeSid(opts?.currentUserSid ?? "");
-        let effectiveEnv = currentUserSid ? { USERSID: currentUserSid } : undefined;
-        let { trusted, untrustedWorld, untrustedGroup } = summarizeWindowsAcl(entries, effectiveEnv);
-        if (!currentUserSid && untrustedGroup.some((entry) => entry.sid && !TRUSTED_SIDS.has(entry.sid))) {
-            currentUserSid = (await resolveWindowsCurrentUserSid({ exec, env: opts?.env })) ?? "";
-            if (currentUserSid) {
-                effectiveEnv = { USERSID: currentUserSid };
-                ({ trusted, untrustedWorld, untrustedGroup } = summarizeWindowsAcl(entries, effectiveEnv));
-            }
-        }
-        return { ok: true, entries, trusted, untrustedWorld, untrustedGroup };
-    }
-    catch (err) {
+const MASK_RIGHTS = [
+    [0x1000_0000, "GA"], [0x8000_0000, "GR"], [0x4000_0000, "GW"], [0x2000_0000, "GE"],
+    [0x0001_0000, "D"], [0x0002_0000, "RC"], [0x0004_0000, "WDAC"], [0x0008_0000, "WO"],
+    [0x0010_0000, "S"], [0x0001, "RD"], [0x0002, "WD"], [0x0004, "AD"],
+    [0x0008, "REA"], [0x0010, "WEA"], [0x0020, "X"], [0x0040, "DC"], [0x0080, "RA"], [0x0100, "WA"],
+];
+function summarizeWindowsOwnerAcl(owner) {
+    const error = owner.error ?? owner.aclError;
+    if (error || owner.daclPresent === undefined || !owner.aces || !owner.currentUserSid) {
         return {
             ok: false, entries: [], trusted: [], untrustedWorld: [], untrustedGroup: [],
-            error: formatPermissionErrorDetail(String(err)),
-            errorDetail: getPermissionCommandFailure(err, command, performance.now() - startedAt),
-            errorCause: err,
+            error: error ?? "Windows ACL query returned incomplete descriptor data",
+            errorDetail: owner.errorDetail, errorCause: owner.errorCause,
         };
     }
+    // A null DACL grants everyone full access; an empty DACL grants nothing.
+    const grants = owner.daclPresent ? owner.aces : [{ sid: "s-1-1-0", mask: 0x001f_01ff, deny: false, inheritOnly: false }];
+    const entries = grants.filter(ace => !ace.deny && !ace.inheritOnly).map(ace => {
+        const rights = ace.mask === 0x001f_01ff ? ["F"] : MASK_RIGHTS.filter(([mask]) => (ace.mask & mask) !== 0).map(([, name]) => name);
+        return {
+            principal: ace.sid, sid: ace.sid, rights, rawRights: "(" + rights.join(",") + ")",
+            // Retain the coarse policy's conservative treatment of read-control and
+            // mutation rights. Denies do not subtract grants or claim effective access.
+            canRead: (ace.mask & 0x9002_0089) !== 0,
+            canWrite: (ace.mask & 0x500d_0156) !== 0,
+        };
+    });
+    return { ok: true, entries, ...summarizeWindowsAcl(entries, { USERSID: owner.currentUserSid }) };
+}
+export async function inspectWindowsAcl(targetPath, opts) {
+    if (opts?.principalTranslationFailed) {
+        const error = new Error("Windows ACL principal SID translation failed");
+        return summarizeWindowsOwnerAcl({ error: String(error), errorCause: error });
+    }
+    let owner;
+    if (process.platform === "win32" && opts?.env === undefined && opts?.exec === undefined) {
+        try {
+            const native = getNativeBinding();
+            const stat = native && await safeStat(targetPath);
+            // Keep the named-query behavior for leaf links; the native reader follows them.
+            const facts = stat?.ok && !stat.isSymlink ? native?.readOwnerAndDacl(targetPath) : undefined;
+            if (facts && !facts.fallbackRequired && facts.isLocal && facts.aceListComplete && facts.unsupportedAceTypes.length === 0 &&
+                facts.aces.every(ace => ace.flags.inherited && ace.mask !== 0)) {
+                // .NET normalizes explicit ACEs, but retains nonzero inherited ACEs in
+                // their original order without merging them. Other forms keep its query.
+                // Adapt descriptor facts only: the public summary owns its SID and rights
+                // classification, which differs from the native secure-read policy.
+                owner = {
+                    daclPresent: facts.daclPresent,
+                    currentUserSid: facts.currentUserSid,
+                    aces: facts.aces.map(ace => ({
+                        sid: ace.sid,
+                        mask: ace.mask,
+                        deny: ace.aceType === "deny",
+                        inheritOnly: ace.flags.inheritOnly,
+                    })),
+                };
+            }
+        }
+        catch {
+            // Preserve this inspector's structured fallback and command diagnostics
+            // when the optional helper or native descriptor query is unavailable.
+        }
+    }
+    owner ??= await inspectWindowsOwner({ targetPath, env: opts?.env, exec: opts?.exec ?? defaultPermissionExec });
+    return summarizeWindowsOwnerAcl({
+        ...owner,
+        currentUserSid: normalizeSid(opts?.currentUserSid ?? "") || owner.currentUserSid,
+    });
 }
 export function formatWindowsAclSummary(summary) {
     if (!summary.ok)

package/dist/pinned-open.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-open.d.ts","sourceRoot":"","sources":["../src/pinned-open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAMzB,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;AAEvE,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,2BAA2B,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW,CAAC;AAE7D,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,OAAO,EAAE,EACT,WAAW,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CACpF,CAAC;AAQF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB,GAAG,oBAAoB,CAoDvB"}
+{"version":3,"file":"pinned-open.d.ts","sourceRoot":"","sources":["../src/pinned-open.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;AAEvE,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,2BAA2B,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,yBAAyB,GAAG,MAAM,GAAG,WAAW,CAAC;AAE7D,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,OAAO,EAAE,EACT,WAAW,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CACpF,CAAC;AAQF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,yBAAyB,CAAC;IACxC,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB,GAAG,oBAAoB,CAqDvB"}

package/dist/pinned-open.js

@@ -3,6 +3,7 @@ import { isUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
+import { realpathSync } from "./realpath.js";
 function isExpectedPathError(error) {
     const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
     return code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP";
@@ -22,7 +23,8 @@ export function openPinnedFileSync(params) {
                 return { ok: false, reason: "validation" };
             }
         }
-        const realPath = params.resolvedPath ?? ioFs.realpathSync(params.filePath);
+        const realPath = params.resolvedPath ??
+            (ioFs === fs ? realpathSync(params.filePath) : ioFs.realpathSync(params.filePath));
         if (isUnsafeDeviceReadPath(realPath)) {
             return { ok: false, reason: "validation" };
         }

package/dist/pinned-operation.js

@@ -27,7 +27,7 @@ function validatePinnedRelativePath(relativePath) {
         relativePath.startsWith("..\\")) {
         throw new FsSafeError("invalid-path", "relative path must not escape root");
     }
-    for (const segment of relativePath.split("/")) {
+    for (const segment of relativePath.split(process.platform === "win32" ? /[\\/]/ : "/")) {
         if (segment === "..") {
             throw new FsSafeError("invalid-path", "relative path must not contain '..'");
         }

package/dist/pinned-write.d.ts

@@ -1,14 +1,15 @@
-import type { Readable } from "node:stream";
 import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
+import { type CopyFileInput } from "./copy-file-input.js";
 export type PinnedWriteInput = {
     kind: "buffer";
     data: string | Buffer;
     encoding?: BufferEncoding;
 } | {
     kind: "stream";
-    stream: Readable;
-};
+    stream: AsyncIterable<Uint8Array | string>;
+    stageBeforePublish?: boolean;
+} | CopyFileInput;
 export type RenameIdentityPolicy = "strict" | "verify-content-with-lock";
 export type PublishedWriteIdentity = Readonly<{
     dev: bigint;
@@ -22,10 +23,13 @@ export type PinnedWriteParams = {
     mode: number;
     sync?: boolean;
     overwrite?: boolean;
+    assertBeforeMutation?: () => void;
+    rejectFinalSymlink?: boolean;
     maxBytes?: number;
     input: PinnedWriteInput;
     rootIdentity?: FileIdentityStat;
     onRenameIdentityMismatch?: "verify-content";
+    onPublished?: (identity: PublishedWriteIdentity) => void;
     verifyPublished?: (fd: number, identity: PublishedWriteIdentity, parentGuard: AnyAsyncDirectoryGuard) => Promise<void>;
 };
 export declare function runPinnedWriteHelper(params: PinnedWriteParams): Promise<FileIdentityStat>;

package/dist/pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAA4F,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAG7J,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAY3D,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAsDzC,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC;IAE5C,eAAe,CAAC,EAAE,CAChB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,sBAAsB,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}
+{"version":3,"file":"pinned-write.d.ts","sourceRoot":"","sources":["../src/pinned-write.ts"],"names":[],"mappings":"AAOA,OAAO,EAA4F,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAG7J,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAa3D,OAAO,EAAE,KAAK,aAAa,EAAqB,MAAM,sBAAsB,CAAC;AAG7E,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC;IAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5F,aAAa,CAAC;AA4ClB,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,0BAA0B,CAAC;AAEzE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,wBAAwB,CAAC,EAAE,gBAAgB,CAAC;IAC5C,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAEzD,eAAe,CAAC,EAAE,CAChB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,sBAAsB,KAChC,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,CAAC;AAEF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgB/F;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,iBAAiB,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA2B3B"}

package/dist/pinned-write.js

@@ -17,6 +17,10 @@ import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { cleanupPinnedFilePath } from "./replace-file-temp-owner.js";
 import { withSidecarLock } from "./sidecar-lock.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
+import { writeAllToFile } from "./write-file-handle.js";
+import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
+import { writeCopyFileToFd } from "./copy-file-input.js";
+import { publishCopyStage } from "./publish-copy-stage.js";
 function byteLength(input, encoding) {
     return typeof input === "string"
         ? Buffer.byteLength(input, encoding ?? "utf8")
@@ -36,20 +40,13 @@ function assertWithinMaxBytes(bytes, maxBytes) {
         throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes (got at least ${bytes})`);
     }
 }
-async function writeStreamToHandle(stream, handle, maxBytes) {
+async function writeStreamToHandle(stream, handle, maxBytes, assertBeforeMutation) {
     let bytes = 0;
     for await (const chunk of stream) {
         const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
         bytes += buffer.byteLength;
         assertWithinMaxBytes(bytes, maxBytes);
-        let offset = 0;
-        while (offset < buffer.byteLength) {
-            const { bytesWritten } = await handle.write(buffer, offset, buffer.byteLength - offset);
-            if (bytesWritten <= 0) {
-                throw new FsSafeError("helper-failed", "fallback stream write made no progress");
-            }
-            offset += bytesWritten;
-        }
+        await writeAllToFile(handle, buffer, { assertBeforeMutation });
     }
 }
 export async function runPinnedWriteHelper(params) {
@@ -95,7 +92,6 @@ async function runPinnedWriteFallback(params) {
         ? { dev: params.rootIdentity.dev, ino: params.rootIdentity.ino } : undefined;
     if (exactRoot)
         await inspectDirectoryIdentity(params.rootPath, exactRoot);
-    const guardOptions = { bigint: exactRoot !== undefined };
     let parentPath = params.relativeParentPath
         ? path.join(params.rootPath, ...params.relativeParentPath.split("/"))
         : params.rootPath;
@@ -107,15 +103,24 @@ async function runPinnedWriteFallback(params) {
         parentPath = await mkdirPathComponentsWithGuards({
             rootReal: params.rootPath,
             targetPath: parentPath,
+            assertBeforeMutation: params.assertBeforeMutation,
             beforeComponent: async (componentPath) => await getFsSafeTestHooks()?.beforeRootFallbackMutation?.("mkdir", componentPath),
         });
     }
     const parentGuard = params.mkdir
-        ? await createAsyncDirectoryGuard(parentPath, guardOptions)
-        : await createNearestExistingDirectoryGuard(params.rootPath, parentPath, guardOptions);
+        ? await createAsyncDirectoryGuard(parentPath, { bigint: true })
+        : await createNearestExistingDirectoryGuard(params.rootPath, parentPath, { bigint: true });
     const targetPath = path.join(parentPath, params.basename);
-    if (params.overwrite === false) {
-        const handle = await withAsyncDirectoryGuards([parentGuard], async () => await fs.open(targetPath, fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL, params.mode), {
+    if (params.overwrite === false && (params.input.kind === "buffer" ||
+        (params.input.kind === "stream" && !params.input.stageBeforePublish))) {
+        const assertBeforeMutation = () => {
+            assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);
+            params.assertBeforeMutation?.();
+        };
+        const handle = await withAsyncDirectoryGuards([parentGuard], async () => {
+            assertBeforeMutation();
+            return await fs.open(targetPath, fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL, params.mode);
+        }, {
             onPostGuardFailure: async (openedHandle) => {
                 // The parent failed verification, so targetPath may now resolve
                 // somewhere else. Close the fd, but do not clean up by path.
@@ -129,15 +134,12 @@ async function runPinnedWriteFallback(params) {
             createdIdentity = verificationIdentity;
             if (params.input.kind === "buffer") {
                 assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
-                if (typeof params.input.data === "string") {
-                    await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
-                }
-                else {
-                    await handle.writeFile(params.input.data);
-                }
+                await writeAllToFile(handle, params.input.data, {
+                    encoding: params.input.encoding, assertBeforeMutation,
+                });
             }
             else {
-                await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
+                await writeStreamToHandle(params.input.stream, handle, params.maxBytes, assertBeforeMutation);
             }
             // Content writes may clear set-ID bits; finalize them through the owned fd.
             await handle.chmod(params.mode);
@@ -176,20 +178,21 @@ async function runPinnedWriteFallback(params) {
     let readHandle;
     let renamed = false;
     try {
+        params.assertBeforeMutation?.();
         handle = await fs.open(tempPath, tempFlags, params.mode);
         let verificationIdentity = fsSync.fstatSync(handle.fd, { bigint: true });
         tempIdentity = verificationIdentity;
         if (params.input.kind === "buffer") {
             assertWithinMaxBytes(byteLength(params.input.data, params.input.encoding), params.maxBytes);
-            if (typeof params.input.data === "string") {
-                await handle.writeFile(params.input.data, params.input.encoding ?? "utf8");
-            }
-            else {
-                await handle.writeFile(params.input.data);
-            }
+            await writeAllToFile(handle, params.input.data, {
+                encoding: params.input.encoding, assertBeforeMutation: params.assertBeforeMutation,
+            });
+        }
+        else if (params.input.kind === "file") {
+            await writeCopyFileToFd(handle.fd, params.input, params.maxBytes, params.assertBeforeMutation);
         }
         else {
-            await writeStreamToHandle(params.input.stream, handle, params.maxBytes);
+            await writeStreamToHandle(params.input.stream, handle, params.maxBytes, params.assertBeforeMutation);
         }
         tempStat = fsSync.fstatSync(handle.fd);
         const tempPathStat = fsSync.lstatSync(tempPath);
@@ -200,10 +203,28 @@ async function runPinnedWriteFallback(params) {
         await handle.chmod(params.mode);
         if (params.sync !== false)
             await syncFileBestEffort(handle);
+        if (params.input.kind === "file")
+            await params.input.verifySource();
         let verifiedIdentity = expectedTempStat;
         await withAsyncDirectoryGuards([parentGuard], async () => {
-            await fs.rename(tempPath, targetPath);
-            renamed = true;
+            assertFinalSymlinkRejected(targetPath, params.rejectFinalSymlink);
+            if (params.overwrite === false) {
+                publishCopyStage({
+                    temporaryPath: tempPath, targetPath, fd: handle.fd,
+                    identity: tempIdentity, parentGuard,
+                    assertBeforeMutation: params.assertBeforeMutation,
+                    onPublished: (identity) => {
+                        renamed = true;
+                        params.onPublished?.(identity);
+                    },
+                });
+            }
+            else {
+                params.assertBeforeMutation?.();
+                await fs.rename(tempPath, targetPath);
+                renamed = true;
+                params.onPublished?.(verificationIdentity);
+            }
             await getFsSafeTestHooks()?.afterPinnedWriteFallbackRename?.(targetPath);
             if (params.sync !== false)
                 await syncDirectoryBestEffort(parentPath);

package/dist/positional-read.d.ts

@@ -0,0 +1,9 @@
+import type { FileHandle } from "node:fs/promises";
+export type ReadFileWindowOptions = {
+    signal?: AbortSignal;
+};
+/** Fills a caller-owned buffer from an explicit position, stopping at EOF. */
+export declare function readFileWindowFully(handle: FileHandle, buffer: Buffer, position: number, { signal }?: ReadFileWindowOptions): Promise<number>;
+/** Synchronous positional read; neither variant advances or closes its descriptor. */
+export declare function readFileWindowFullySync(fd: number, buffer: Buffer, position: number): number;
+//# sourceMappingURL=positional-read.d.ts.map

package/dist/positional-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"positional-read.d.ts","sourceRoot":"","sources":["../src/positional-read.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AASF,8EAA8E;AAC9E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,EAAE,MAAM,EAAE,GAAE,qBAA0B,GACrC,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,sFAAsF;AACtF,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAW5F"}

package/dist/positional-read.js

@@ -0,0 +1,36 @@
+import fs from "node:fs";
+// Node's synchronous read length is a signed 32-bit value on supported runtimes.
+const MAX_READ_BYTES = 0x7fffffff;
+function validateWindow(buffer, position) {
+    if (!Number.isSafeInteger(position) || position < 0 ||
+        !Number.isSafeInteger(position + buffer.length)) {
+        throw new RangeError("read position and window end must be non-negative safe integers");
+    }
+}
+/** Fills a caller-owned buffer from an explicit position, stopping at EOF. */
+export async function readFileWindowFully(handle, buffer, position, { signal } = {}) {
+    validateWindow(buffer, position);
+    signal?.throwIfAborted();
+    let total = 0;
+    while (total < buffer.length) {
+        const { bytesRead } = await handle.read(buffer, total, Math.min(buffer.length - total, MAX_READ_BYTES), position + total);
+        // Settle the pending read before cancellation lets the caller reuse its buffer or handle.
+        signal?.throwIfAborted();
+        if (bytesRead === 0)
+            break;
+        total += bytesRead;
+    }
+    return total;
+}
+/** Synchronous positional read; neither variant advances or closes its descriptor. */
+export function readFileWindowFullySync(fd, buffer, position) {
+    validateWindow(buffer, position);
+    let total = 0;
+    while (total < buffer.length) {
+        const bytesRead = fs.readSync(fd, buffer, total, Math.min(buffer.length - total, MAX_READ_BYTES), position + total);
+        if (bytesRead === 0)
+            break;
+        total += bytesRead;
+    }
+    return total;
+}

package/dist/private-temp-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-temp-workspace.d.ts","sourceRoot":"","sources":["../src/private-temp-workspace.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AASzB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,IAAI,0BAA0B,CAAC;IACtC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AA4KF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,iBAAiB,CAgGnB;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,GACvC,CAAC,CAUH"}
+{"version":3,"file":"private-temp-workspace.d.ts","sourceRoot":"","sources":["../src/private-temp-workspace.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAWzB,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACV,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,0BAA0B,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,SAAS,CAAC;IACjB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,uBAAuB,CAAC;IAClC,KAAK,EAAE,aAAa,CAAC;IACrB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IAC3D,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAClD,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,MAAM,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,OAAO,IAAI,0BAA0B,CAAC;IACtC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AA4KF,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,GAC5B,iBAAiB,CAgGnB;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,oBAAoB,EAC7B,GAAG,EAAE,CAAC,SAAS,EAAE,iBAAiB,KAAK,CAAC,GACvC,CAAC,CAUH"}

package/dist/private-temp-workspace.js

@@ -5,6 +5,8 @@ import path from "node:path";
 import { fileStore, fileStoreSync, } from "./file-store.js";
 import { FsSafeError } from "./errors.js";
 import { isNotFoundPathError } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { throwFsSafeReadError } from "./root-errors.js";
 import { matchRootFileOpenFailure, openRootFileSync, } from "./root-file.js";
 import { registerTempPathForExit, } from "./temp-cleanup.js";
@@ -66,7 +68,7 @@ function throwTempWorkspaceOpenFailure(failure) {
     });
 }
 async function ensurePrivateDirectory(dir, mode) {
-    await fs.mkdir(dir, { recursive: true, mode });
+    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true, mode });
     const stat = fsSync.statSync(dir);
     if (!stat.isDirectory()) {
         throw new Error(`Temp root must be a directory: ${dir}`);
@@ -74,7 +76,7 @@ async function ensurePrivateDirectory(dir, mode) {
     await fs.chmod(dir, mode).catch(() => undefined);
 }
 function ensurePrivateDirectorySync(dir, mode) {
-    fsSync.mkdirSync(dir, { recursive: true, mode });
+    fsSync.mkdirSync(recursiveMkdirPath(dir), { recursive: true, mode });
     const stat = fsSync.statSync(dir);
     if (!stat.isDirectory()) {
         throw new Error(`Temp root must be a directory: ${dir}`);
@@ -93,7 +95,7 @@ async function createTempWorkspace(options) {
     const requestedRoot = path.resolve(options.rootDir);
     let root = requestedRoot;
     try {
-        root = fsSync.realpathSync.native(requestedRoot);
+        root = realpathSync.native(requestedRoot);
     }
     catch {
         root = requestedRoot;
@@ -194,7 +196,7 @@ export function tempWorkspaceSync(options) {
     const requestedRoot = path.resolve(options.rootDir);
     let root = requestedRoot;
     try {
-        root = fsSync.realpathSync.native(requestedRoot);
+        root = realpathSync.native(requestedRoot);
     }
     catch {
         root = requestedRoot;

package/dist/publish-copy-stage.d.ts

@@ -0,0 +1,13 @@
+import { type BigIntStats } from "node:fs";
+import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
+import type { PublishedWriteIdentity } from "./pinned-write.js";
+export declare function publishCopyStage(params: {
+    temporaryPath: string;
+    targetPath: string;
+    fd: number;
+    identity: BigIntStats;
+    parentGuard: AnyAsyncDirectoryGuard;
+    assertBeforeMutation?: () => void;
+    onPublished?: (identity: PublishedWriteIdentity) => void;
+}): void;
+//# sourceMappingURL=publish-copy-stage.d.ts.map

package/dist/publish-copy-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-copy-stage.d.ts","sourceRoot":"","sources":["../src/publish-copy-stage.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAIhE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,EAAE,sBAAsB,CAAC;IACpC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,IAAI,CAAC;CAC1D,GAAG,IAAI,CAqCP"}

package/dist/publish-copy-stage.js

@@ -0,0 +1,47 @@
+import fs, {} from "node:fs";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+// Node has no portable no-replace rename. Link only our completed private stage,
+// then unlink it in the same JS turn so local readers never observe two names.
+export function publishCopyStage(params) {
+    const { identity, temporaryPath, targetPath } = params;
+    const staged = fs.lstatSync(temporaryPath, { bigint: true });
+    const opened = fs.fstatSync(params.fd, { bigint: true });
+    if (!staged.isFile() || staged.isSymbolicLink() || staged.nlink !== 1n ||
+        !sameFileIdentityForCleanup(staged, identity) ||
+        !sameFileIdentityForCleanup(opened, identity)) {
+        throw new FsSafeError("path-mismatch", "exclusive copy stage changed before publication");
+    }
+    params.assertBeforeMutation?.();
+    fs.linkSync(temporaryPath, targetPath);
+    let observerRejected = false;
+    let observerError;
+    try {
+        params.onPublished?.(identity);
+    }
+    catch (error) {
+        observerRejected = true;
+        observerError = error;
+    }
+    try {
+        const parent = fs.lstatSync(path.dirname(temporaryPath), { bigint: true });
+        const current = fs.lstatSync(temporaryPath, { bigint: true });
+        if (parent.isSymbolicLink() || !parent.isDirectory() ||
+            !sameFileIdentityForCleanup(parent, params.parentGuard.stat) ||
+            current.isSymbolicLink() || !current.isFile() ||
+            !sameFileIdentityForCleanup(current, identity)) {
+            throw new FsSafeError("path-mismatch", "published copy temporary name changed before cleanup");
+        }
+        // This removes the stage's name, never the published destination or source.
+        fs.unlinkSync(temporaryPath);
+    }
+    catch (error) {
+        throw new FsSafeError("helper-failed", "published copy temporary cleanup failed", {
+            cause: observerRejected ? new AggregateError([observerError, error], "observer and cleanup failed") : error,
+            details: { publication: "published", path: targetPath, dev: identity.dev, ino: identity.ino, cleanup: "failed" },
+        });
+    }
+    if (observerRejected)
+        throw observerError;
+}

package/dist/publish-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA0ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}
+{"version":3,"file":"publish-file.d.ts","sourceRoot":"","sources":["../src/publish-file.ts"],"names":[],"mappings":"AACA,OAAe,EAAoB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAC;AAI/D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAML,KAAK,qCAAqC,EAC3C,MAAM,2BAA2B,CAAC;AAGnC,YAAY,EACV,2BAA2B,EAC3B,wCAAwC,EACxC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,GACtC,MAAM,2BAA2B,CAAC;AAEnC,MAAM,MAAM,4BAA4B,GACpC,cAAc,GACd,eAAe,GACf,kBAAkB,CAAC;AAEvB,MAAM,MAAM,0BAA0B,GAAG;IACvC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC3D,QAAQ,EAAE,KAAK,CAAC;IAChB,aAAa,EAAE,oBAAoB,CAAC;CACrC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AA2ND,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,aAAa,CAAC,EAAE,qCAAqC,CAAC;IACtD,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4MtC"}

package/dist/publish-file.js

@@ -90,9 +90,9 @@ async function copyPinnedSource(params) {
                 throw error;
             }
             let target;
-            let createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
-            rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
             try {
+                let createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
+                rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
                 fsSync.fchmodSync(nativeFd, 0o600);
                 createdIdentity = fsSync.fstatSync(nativeFd, { bigint: true });
                 await getFsSafeTestHooks()?.afterPublishTargetCreated?.("exclusive-copy", params.targetPath, createdIdentity);
@@ -106,8 +106,9 @@ async function copyPinnedSource(params) {
                     throw new FsSafeError("path-mismatch", "native publication target changed after copy");
                 }
                 const hashed = await hashFileHandle(target, params.native);
-                fsSync.closeSync(nativeFd);
+                const completedFd = nativeFd;
                 nativeFd = undefined;
+                fsSync.closeSync(completedFd);
                 return {
                     handle: target,
                     exactIdentity: opened,
@@ -126,9 +127,9 @@ async function copyPinnedSource(params) {
         }
     }
     const target = await fs.open(params.targetPath, "wx+", 0o600);
-    const createdIdentity = fsSync.fstatSync(target.fd, { bigint: true });
-    rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
     try {
+        const createdIdentity = fsSync.fstatSync(target.fd, { bigint: true });
+        rememberCreatedTarget(params.failure, createdIdentity, "copy-verify");
         await target.chmod(0o600);
         const exactIdentity = fsSync.fstatSync(target.fd, { bigint: true });
         await getFsSafeTestHooks()?.afterPublishTargetCreated?.("exclusive-copy", params.targetPath, exactIdentity);

package/dist/realpath.d.ts

@@ -0,0 +1,4 @@
+export declare const realpathSync: ((input: string) => string) & {
+    native: (input: string) => string;
+};
+//# sourceMappingURL=realpath.d.ts.map