@poe-platform/safe-bash 0.1.673 → 0.1.675

package/dist/safe-bash/commands/network/index.browser.js

@@ -10,17 +10,17 @@ import {
   curlCommands,
   defaultNetworkLimits,
   networkCommands
-} from "../../chunks/chunk-W4HGKCDM.js";
-import "../../chunks/chunk-AYSSIJJN.js";
-import "../../chunks/chunk-5LGU452F.js";
-import "../../chunks/chunk-E72YNOKL.js";
-import "../../chunks/chunk-FMPZXGZX.js";
-import "../../chunks/chunk-HUF6AIWZ.js";
-import "../../chunks/chunk-JN25474T.js";
-import "../../chunks/chunk-JAZIACHR.js";
-import "../../chunks/chunk-4FOLIMDG.js";
-import "../../chunks/chunk-4GS3VKVN.js";
-import "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-IVMNRAZQ.js";
+import "../../chunks/chunk-Q6FBCQOS.js";
+import "../../chunks/chunk-ZBJOE26D.js";
+import "../../chunks/chunk-ZDYA3SLF.js";
+import "../../chunks/chunk-RPZQ4UUC.js";
+import "../../chunks/chunk-TJJ3M2PO.js";
+import "../../chunks/chunk-6N3NP45C.js";
+import "../../chunks/chunk-CYHOHFST.js";
+import "../../chunks/chunk-AMEBMTDV.js";
+import "../../chunks/chunk-URHHMYD3.js";
+import "../../chunks/chunk-O4SKIJ5J.js";
 export {
   CurlError,
   cloudflareWorkerNetworkLimits,

package/dist/safe-bash/commands/node/index.browser.js

@@ -2,14 +2,14 @@ import {
   createSafeJsNodeCommand,
   createSafeJsNodeCommands,
   safeJsNodeCommands
-} from "../../chunks/chunk-G6NUMAWB.js";
-import "../../chunks/chunk-FMPZXGZX.js";
-import "../../chunks/chunk-HUF6AIWZ.js";
-import "../../chunks/chunk-JN25474T.js";
-import "../../chunks/chunk-JAZIACHR.js";
-import "../../chunks/chunk-4FOLIMDG.js";
-import "../../chunks/chunk-4GS3VKVN.js";
-import "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-MH7USUFB.js";
+import "../../chunks/chunk-RPZQ4UUC.js";
+import "../../chunks/chunk-TJJ3M2PO.js";
+import "../../chunks/chunk-6N3NP45C.js";
+import "../../chunks/chunk-CYHOHFST.js";
+import "../../chunks/chunk-AMEBMTDV.js";
+import "../../chunks/chunk-URHHMYD3.js";
+import "../../chunks/chunk-O4SKIJ5J.js";
 export {
   createSafeJsNodeCommand as createNodeCommand,
   createSafeJsNodeCommands as createNodeCommands,

package/dist/safe-bash/commands/op/index.browser.js

@@ -1,12 +1,12 @@
 import {
   resolvePath
-} from "../../chunks/chunk-4FOLIMDG.js";
+} from "../../chunks/chunk-AMEBMTDV.js";
 import {
   readBytes
-} from "../../chunks/chunk-4GS3VKVN.js";
+} from "../../chunks/chunk-URHHMYD3.js";
 import {
   init_platform
-} from "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-O4SKIJ5J.js";
 
 // packages/safe-bash/src/commands/op/index.ts
 init_platform();

package/dist/safe-bash/commands/pr/index.browser.js

@@ -2,14 +2,14 @@ import {
   createPrCommand,
   createPrCommands,
   prCommands
-} from "../../chunks/chunk-EQQUSBQL.js";
-import "../../chunks/chunk-E72YNOKL.js";
-import "../../chunks/chunk-HUF6AIWZ.js";
-import "../../chunks/chunk-JN25474T.js";
-import "../../chunks/chunk-JAZIACHR.js";
-import "../../chunks/chunk-4FOLIMDG.js";
-import "../../chunks/chunk-4GS3VKVN.js";
-import "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-3CSVGCNG.js";
+import "../../chunks/chunk-ZDYA3SLF.js";
+import "../../chunks/chunk-TJJ3M2PO.js";
+import "../../chunks/chunk-6N3NP45C.js";
+import "../../chunks/chunk-CYHOHFST.js";
+import "../../chunks/chunk-AMEBMTDV.js";
+import "../../chunks/chunk-URHHMYD3.js";
+import "../../chunks/chunk-O4SKIJ5J.js";
 export {
   createPrCommand,
   createPrCommands,

package/dist/safe-bash/commands/python/index.browser.js

@@ -7,18 +7,18 @@ import {
   createPythonPackageManifestStore,
   pythonCommands,
   pythonDocumentPackages
-} from "../../chunks/chunk-QYWBN35Y.js";
-import "../../chunks/chunk-5LGU452F.js";
+} from "../../chunks/chunk-6R7IR2MV.js";
+import "../../chunks/chunk-ZBJOE26D.js";
 import {
   PythonFailure,
   inspectPythonCapabilities
-} from "../../chunks/chunk-J3KNDY7M.js";
-import "../../chunks/chunk-E72YNOKL.js";
-import "../../chunks/chunk-JN25474T.js";
-import "../../chunks/chunk-JAZIACHR.js";
-import "../../chunks/chunk-4FOLIMDG.js";
-import "../../chunks/chunk-4GS3VKVN.js";
-import "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-3G3EZZ63.js";
+import "../../chunks/chunk-ZDYA3SLF.js";
+import "../../chunks/chunk-6N3NP45C.js";
+import "../../chunks/chunk-CYHOHFST.js";
+import "../../chunks/chunk-AMEBMTDV.js";
+import "../../chunks/chunk-URHHMYD3.js";
+import "../../chunks/chunk-O4SKIJ5J.js";
 export {
   PythonFailure,
   PythonPackageConflictError,

package/dist/safe-bash/commands/python/worker.browser.js

@@ -1,10 +1,10 @@
 import {
   PythonFailure,
   parsePythonInvocation
-} from "../../chunks/chunk-J3KNDY7M.js";
+} from "../../chunks/chunk-3G3EZZ63.js";
 import {
   init_platform
-} from "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-O4SKIJ5J.js";
 
 // packages/safe-bash/src/commands/python/worker.ts
 init_platform();

package/dist/safe-bash/commands/tsort/index.browser.js

@@ -2,14 +2,14 @@ import {
   createTsortCommand,
   createTsortCommands,
   tsortCommands
-} from "../../chunks/chunk-Q3BPIW36.js";
-import "../../chunks/chunk-E72YNOKL.js";
-import "../../chunks/chunk-HUF6AIWZ.js";
-import "../../chunks/chunk-JN25474T.js";
-import "../../chunks/chunk-JAZIACHR.js";
-import "../../chunks/chunk-4FOLIMDG.js";
-import "../../chunks/chunk-4GS3VKVN.js";
-import "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-RZXOHP7M.js";
+import "../../chunks/chunk-ZDYA3SLF.js";
+import "../../chunks/chunk-TJJ3M2PO.js";
+import "../../chunks/chunk-6N3NP45C.js";
+import "../../chunks/chunk-CYHOHFST.js";
+import "../../chunks/chunk-AMEBMTDV.js";
+import "../../chunks/chunk-URHHMYD3.js";
+import "../../chunks/chunk-O4SKIJ5J.js";
 export {
   createTsortCommand,
   createTsortCommands,

package/dist/safe-bash/commands/xml/index.browser.js

@@ -2,15 +2,15 @@ import {
   createXmlCommands,
   defaultXmlQueryLimits,
   xmlCommands
-} from "../../chunks/chunk-B62IHTWU.js";
-import "../../chunks/chunk-ENWBYBE5.js";
-import "../../chunks/chunk-FMPZXGZX.js";
-import "../../chunks/chunk-HUF6AIWZ.js";
-import "../../chunks/chunk-JN25474T.js";
-import "../../chunks/chunk-JAZIACHR.js";
-import "../../chunks/chunk-4FOLIMDG.js";
-import "../../chunks/chunk-4GS3VKVN.js";
-import "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-JDH27I5L.js";
+import "../../chunks/chunk-JFQCOS4H.js";
+import "../../chunks/chunk-RPZQ4UUC.js";
+import "../../chunks/chunk-TJJ3M2PO.js";
+import "../../chunks/chunk-6N3NP45C.js";
+import "../../chunks/chunk-CYHOHFST.js";
+import "../../chunks/chunk-AMEBMTDV.js";
+import "../../chunks/chunk-URHHMYD3.js";
+import "../../chunks/chunk-O4SKIJ5J.js";
 export {
   createXmlCommands,
   defaultXmlQueryLimits,

package/dist/safe-bash/commands/yq/index.browser.js

@@ -2,16 +2,16 @@ import {
   createYqCommand,
   createYqCommands,
   yqCommands
-} from "../../chunks/chunk-3Y7MJXHG.js";
-import "../../chunks/chunk-E72YNOKL.js";
-import "../../chunks/chunk-ENWBYBE5.js";
-import "../../chunks/chunk-FMPZXGZX.js";
-import "../../chunks/chunk-HUF6AIWZ.js";
-import "../../chunks/chunk-JN25474T.js";
-import "../../chunks/chunk-JAZIACHR.js";
-import "../../chunks/chunk-4FOLIMDG.js";
-import "../../chunks/chunk-4GS3VKVN.js";
-import "../../chunks/chunk-CBI5DWCN.js";
+} from "../../chunks/chunk-AJMYOERL.js";
+import "../../chunks/chunk-ZDYA3SLF.js";
+import "../../chunks/chunk-JFQCOS4H.js";
+import "../../chunks/chunk-RPZQ4UUC.js";
+import "../../chunks/chunk-TJJ3M2PO.js";
+import "../../chunks/chunk-6N3NP45C.js";
+import "../../chunks/chunk-CYHOHFST.js";
+import "../../chunks/chunk-AMEBMTDV.js";
+import "../../chunks/chunk-URHHMYD3.js";
+import "../../chunks/chunk-O4SKIJ5J.js";
 export {
   createYqCommand,
   createYqCommands,

package/dist/safe-bash/core.browser.js

@@ -3,18 +3,18 @@ import {
   createHexdumpCommand,
   createHexdumpCommands,
   hexdumpCommands
-} from "./chunks/chunk-CL3DDB37.js";
+} from "./chunks/chunk-YSWBQWQ4.js";
 import {
   createIconvCommand,
   createIconvCommands,
   iconvCommands
-} from "./chunks/chunk-CMXB2KEU.js";
+} from "./chunks/chunk-ADKIY2N6.js";
 import {
   createDos2unixCommand,
   createLineEndingCommands,
   createUnix2dosCommand,
   lineEndingCommands
-} from "./chunks/chunk-V62VGSQE.js";
+} from "./chunks/chunk-GXY5T7FE.js";
 import {
   Interpreter,
   createYqCommand,
@@ -25,7 +25,7 @@ import {
   rawValues,
   stringify,
   yqCommands
-} from "./chunks/chunk-3Y7MJXHG.js";
+} from "./chunks/chunk-AJMYOERL.js";
 import {
   CurlError,
   cloudflareWorkerNetworkLimits,
@@ -38,7 +38,7 @@ import {
   curlCommands,
   defaultNetworkLimits,
   networkCommands
-} from "./chunks/chunk-W4HGKCDM.js";
+} from "./chunks/chunk-IVMNRAZQ.js";
 import {
   SafeJsCommandLimitError,
   createSafeJsNodeCommand,
@@ -49,7 +49,7 @@ import {
   safeJsNodeCommands,
   stringValue,
   withSignal
-} from "./chunks/chunk-G6NUMAWB.js";
+} from "./chunks/chunk-MH7USUFB.js";
 import {
   AvailableRecords,
   EreLedger,
@@ -69,31 +69,31 @@ import {
   exprMatchCeilings,
   matchEre,
   withRegexSession
-} from "./chunks/chunk-EW3TYPG2.js";
+} from "./chunks/chunk-ZAH7KZHM.js";
 import {
   openFileOutput,
   writeFileOutput
-} from "./chunks/chunk-AYSSIJJN.js";
+} from "./chunks/chunk-Q6FBCQOS.js";
 import {
   createPrCommand,
   createPrCommands,
   prCommands
-} from "./chunks/chunk-EQQUSBQL.js";
+} from "./chunks/chunk-3CSVGCNG.js";
 import {
   createTsortCommand,
   createTsortCommands,
   tsortCommands
-} from "./chunks/chunk-Q3BPIW36.js";
+} from "./chunks/chunk-RZXOHP7M.js";
 import {
   createFactorCommand,
   createFactorCommands,
   factorCommands
-} from "./chunks/chunk-PU6UAMLP.js";
+} from "./chunks/chunk-REGMDUIG.js";
 import {
   createGetoptCommand,
   createGetoptCommands,
   getoptCommands
-} from "./chunks/chunk-FBDSXZ2K.js";
+} from "./chunks/chunk-7KY55OSN.js";
 import {
   Chi,
   HashMD,
@@ -114,33 +114,33 @@ import {
   sha256,
   sha384,
   sha512
-} from "./chunks/chunk-QYWBN35Y.js";
+} from "./chunks/chunk-6R7IR2MV.js";
 import {
   bindFileOutputBudget,
   openCommandFile
-} from "./chunks/chunk-5LGU452F.js";
+} from "./chunks/chunk-ZBJOE26D.js";
 import {
   PythonFailure,
   inspectPythonCapabilities
-} from "./chunks/chunk-J3KNDY7M.js";
+} from "./chunks/chunk-3G3EZZ63.js";
 import {
   createLlmCommands,
   llmCommands
-} from "./chunks/chunk-HHA6W63G.js";
+} from "./chunks/chunk-FZ4N3GXF.js";
 import {
   createOutputOperation
-} from "./chunks/chunk-E72YNOKL.js";
-import "./chunks/chunk-JFAGVXK4.js";
+} from "./chunks/chunk-ZDYA3SLF.js";
+import "./chunks/chunk-CXOGU5FI.js";
 import {
   classify,
   createElevenLabsProvider,
   createOpenAiProvider
-} from "./chunks/chunk-BRSXHYVB.js";
+} from "./chunks/chunk-FAPYXUJX.js";
 import {
   createXmlCommands,
   defaultXmlQueryLimits,
   xmlCommands
-} from "./chunks/chunk-B62IHTWU.js";
+} from "./chunks/chunk-JDH27I5L.js";
 import {
   Budget,
   JqError,
@@ -153,7 +153,7 @@ import {
   resolveJqLimits,
   truth,
   wellFormed
-} from "./chunks/chunk-ENWBYBE5.js";
+} from "./chunks/chunk-JFQCOS4H.js";
 import {
   RecordBuffer,
   UsageError,
@@ -185,11 +185,11 @@ import {
   textOutputRequirements,
   value,
   writeDiagnostic
-} from "./chunks/chunk-FMPZXGZX.js";
+} from "./chunks/chunk-RPZQ4UUC.js";
 import {
   PublicDiagnostic,
   publicDiagnosticMessage
-} from "./chunks/chunk-HUF6AIWZ.js";
+} from "./chunks/chunk-TJJ3M2PO.js";
 import {
   cancelTurn,
   inheritYieldCheckpoint,
@@ -197,7 +197,7 @@ import {
   registerYieldCheckpoint,
   scheduleTurn,
   yieldTurn
-} from "./chunks/chunk-JN25474T.js";
+} from "./chunks/chunk-6N3NP45C.js";
 import {
   CommandArgumentIdentityError,
   CommandRegistry,
@@ -211,7 +211,7 @@ import {
   shellValueRetainedBytes,
   shellValueText,
   validateExitCode
-} from "./chunks/chunk-JAZIACHR.js";
+} from "./chunks/chunk-CYHOHFST.js";
 import {
   basename,
   dirname,
@@ -221,7 +221,7 @@ import {
   relativePath,
   resolvePath,
   validatePath
-} from "./chunks/chunk-4FOLIMDG.js";
+} from "./chunks/chunk-AMEBMTDV.js";
 import {
   FsError,
   collectBytes,
@@ -236,11 +236,11 @@ import {
   toFsError,
   writeBytes,
   writeText
-} from "./chunks/chunk-4GS3VKVN.js";
+} from "./chunks/chunk-URHHMYD3.js";
 import {
   import_buffer,
   init_platform
-} from "./chunks/chunk-CBI5DWCN.js";
+} from "./chunks/chunk-O4SKIJ5J.js";
 
 // packages/safe-bash/src/core.browser.ts
 init_platform();
@@ -20083,13 +20083,13 @@ async function createCodec(options2, signal, factory) {
   if (!factory) {
     switch (options2.format) {
       case "bzip2":
-        factory = (await import("./chunks/bz2-IHIZQMGV.js")).default;
+        factory = (await import("./chunks/bz2-GFOVKOE2.js")).default;
         break;
       case "xz":
-        factory = (await import("./chunks/xz-ZQAJM52W.js")).default;
+        factory = (await import("./chunks/xz-JNAU6ET3.js")).default;
         break;
       case "zstd":
-        factory = (await import("./chunks/zstd-2EW5DYSH.js")).default;
+        factory = (await import("./chunks/zstd-ATGZPMKA.js")).default;
         break;
     }
   }
@@ -28625,7 +28625,8 @@ Archive operations
   Removal needs atomic filesystem support; excluded/nonempty directories remain.
   -DF writes size/time differences and new members to required separate -O output.
   -g grows by retaining validated local records when only adding members;
-  replacements/deletions rebuild. Publication always uses owned atomic staging.
+  replacements/deletions rebuild. Publication uses owned atomic staging or
+  conditional byte publication with opaque host identities and versions.
   -b directory selects the VFS staging directory, also spooling stdout archives.
   Cross-provider publication must be supported by the filesystem; no host copy.
   -J removes a prefix only after validating the complete embedded ZIP and CRCs.
@@ -28723,6 +28724,21 @@ This is the virtual implementation license, not the native Info-ZIP license.
 // packages/safe-bash/src/commands/archive/zip/safety.ts
 init_platform();
 import { retainFileSystemCleanup as retainFileSystemCleanup2 } from "@poe-platform/safe-fs/core";
+function hasZipIdentity(stat) {
+  return hasIdentity(stat) || (typeof stat.identityScope === "object" && stat.identityScope !== null || typeof stat.identityScope === "symbol") && typeof stat.opaqueIdentity === "string" && stat.opaqueIdentity.length > 0 && stat.opaqueIdentity.length <= 4096 && hasZipVersion(stat);
+}
+function hasZipVersion(stat) {
+  return typeof stat.opaqueVersion === "string" && stat.opaqueVersion.length > 0 && stat.opaqueVersion.length <= 4096;
+}
+function sameZipIdentity(first, second) {
+  return sameIdentity2(first, second) || hasZipIdentity(first) && hasZipIdentity(second) && first.opaqueIdentity !== void 0 && first.identityScope === second.identityScope && first.opaqueIdentity === second.opaqueIdentity;
+}
+async function safeZipFile(scope, path, stat) {
+  if (stat.type !== "file" || !hasZipIdentity(stat)) return false;
+  if (stat.nlink !== void 0) return stat.nlink === 1;
+  const capabilities = await scope.operation(() => scope.context.fs.capabilitiesFor?.(path, { signal: scope.context.signal }) ?? scope.context.fs.capabilities);
+  return stat.opaqueIdentity !== void 0 && capabilities.hardlinks === false;
+}
 var ZipScope = class {
   constructor(original, limits) {
     this.original = original;
@@ -28899,6 +28915,46 @@ async function stageZip(scope, prepared, consume) {
 async function publishZip(scope, prepared) {
   const { fs, signal } = scope.context;
   const capabilities = await scope.operation(() => fs.capabilitiesFor?.(prepared.output, { signal, create: true }) ?? fs.capabilities);
+  if (capabilities.atomicFilePublication === true && fs.publishFileConditional && !prepared.validate && prepared.stagingName === void 0) {
+    if (capabilities.readOnly === true || capabilities.write === false) fail("ZIP destination is not writable");
+    if (prepared.existing && (!hasZipIdentity(prepared.existing) || !hasZipVersion(prepared.existing))) fail("ZIP conditional publication requires an observed opaque version");
+    const parent = await scope.operation(() => fs.realpath(prepared.parentName, { signal }));
+    if (parent !== prepared.parent) fail("archive parent changed before publication");
+    let size = 0;
+    let completed = false;
+    let active = true;
+    const input3 = prepared.source ?? { async *[Symbol.asyncIterator]() {
+      yield prepared.bytes ?? new Uint8Array();
+    } };
+    const source2 = scope.source((async function* () {
+      for await (const chunk of readBytes(input3, signal)) {
+        if (!active) fail("ZIP publication source is closed");
+        if (chunk.length > scope.limits.maxArchiveBytes - size) fail("archive byte limit exceeded");
+        size += chunk.length;
+        let owned = chunk;
+        if (prepared.source) await writeFileOutput(scope.context, chunk, async (bytes3) => {
+          owned = Uint8Array.from(bytes3);
+        });
+        yield owned;
+      }
+      completed = true;
+    })());
+    try {
+      const receipt = await scope.operation(() => fs.publishFileConditional(prepared.output, source2, {
+        signal,
+        parent: prepared.parentStat,
+        expected: prepared.existing ?? null,
+        maxBytes: scope.limits.maxArchiveBytes,
+        ...prepared.existing && capabilities.permissions !== false ? { mode: prepared.existing.mode & 4095 } : {},
+        ...prepared.mtimeMs === void 0 ? {} : { mtimeMs: prepared.mtimeMs }
+      }));
+      if (!completed || receipt.type !== "file" || receipt.size !== size || !hasZipIdentity(receipt) || !hasZipVersion(receipt) || prepared.existing?.opaqueVersion === receipt.opaqueVersion) fail("Invalid ZIP conditional publication acknowledgement");
+    } finally {
+      active = false;
+      await scope.closeInputs();
+    }
+    return;
+  }
   if (capabilities.atomicFileStaging !== true || !fs.publishStagedFile) fail("ZIP publication requires atomic owned file staging");
   await stageZip(scope, {
     ...prepared,
@@ -29795,7 +29851,7 @@ function memberName(path, limits) {
   return name2 === "." ? "" : name2;
 }
 function unchanged4(before, after) {
-  return before.type === after.type && before.size === after.size && before.mode === after.mode && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs && before.nlink === after.nlink && (!hasIdentity(before) || sameIdentity2(before, after));
+  return before.type === after.type && before.size === after.size && before.mode === after.mode && before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs && before.nlink === after.nlink && before.opaqueVersion === after.opaqueVersion && before.revision === after.revision && (!hasZipIdentity(before) || sameZipIdentity(before, after));
 }
 async function inspectSource(scope, path, storeLinks) {
   const { fs, signal } = scope.context;
@@ -29831,7 +29887,7 @@ async function prepare(scope, parsed, budget, log, host2) {
     checkPath(name2, limits);
     const parent = await scope.operation(() => context2.fs.realpath(name2, { signal: context2.signal }));
     const parentStat = await scope.operation(() => context2.fs.lstat(parent, { signal: context2.signal }));
-    if (parentStat.type !== "directory" || !hasIdentity(parentStat)) fail("ZIP temporary path requires a directory with known backing identity");
+    if (parentStat.type !== "directory" || !hasZipIdentity(parentStat)) fail("ZIP temporary path requires a directory with known backing identity");
     temporary = { name: name2, parent, parentStat };
   }
   let publication;
@@ -29868,13 +29924,13 @@ async function prepare(scope, parsed, budget, log, host2) {
         if (typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "EACCES")) throw new ZipFailure(18, "File not found or no read permission", parsed.archive);
         throw error;
       }
-      if (input3 === output2 || existing2 && publication?.existing && sameIdentity2(existing2, publication.existing)) throw new ZipFailure(16, "Invalid command arguments", `--out path must be different than in path: ${parsed.archive}`);
+      if (input3 === output2 || existing2 && publication?.existing && sameZipIdentity(existing2, publication.existing)) throw new ZipFailure(16, "Invalid command arguments", `--out path must be different than in path: ${parsed.archive}`);
     }
   }
   if ((parsed.action === "copy" || parsed.showFiles !== void 0 && !parsed.operands.length || parsed.output !== void 0 && parsed.archive !== "-") && !existing2) throw new ZipFailure(18, "File not found or no read permission", parsed.archive);
-  if (publication?.existing && (publication.existing.type !== "file" || !hasIdentity(publication.existing) || publication.existing.nlink !== 1)) fail("output archive requires a regular, single-link file with known backing identity");
+  if (publication?.existing && !await safeZipFile(scope, publication.output, publication.existing)) fail("output archive requires a regular, single-link file with known backing identity");
   if (parsed.archive === "-" && parsed.test && !parsed.quiet) await budget.output("	zip warning: can't use -T on stdout, -T ignored\n");
-  if (existing2 && (existing2.type !== "file" || !hasIdentity(existing2) || existing2.nlink !== 1)) fail("updating archive requires a regular, single-link file with known backing identity; archive aliases are unsupported");
+  if (existing2 && !await safeZipFile(scope, input3, existing2)) fail("updating archive requires a regular, single-link file with known backing identity; archive aliases are unsupported");
   let archive = { entries: [], comment: new Uint8Array() };
   let originalBytes;
   let inputPaths = [];
@@ -29889,7 +29945,7 @@ async function prepare(scope, parsed, budget, log, host2) {
     if (resolved.disks && resolved.disks.starts.length > 1) inputSplit = Math.max(65536, ...resolved.disks.lengths.slice(0, -1));
     if (publication && parsed.output !== void 0) for (const path of inputPaths) {
       const stat = await scope.stat(path);
-      if (publication.output === path || stat && publication.existing && sameIdentity2(stat, publication.existing)) fail("ZIP output aliases an input volume");
+      if (publication.output === path || stat && publication.existing && sameZipIdentity(stat, publication.existing)) fail("ZIP output aliases an input volume");
     }
     if ((parsed.split || resolved.disks) && parsed.output === void 0 && parsed.showFiles === void 0) throw new ZipFailure(16, "Invalid command arguments", "split archives require a separate --out destination");
     if (parsed.repair || parsed.adjust) {
@@ -30049,7 +30105,7 @@ async function prepare(scope, parsed, budget, log, host2) {
       return;
     }
     checkPath(canonical, limits);
-    if (canonical === output2 || canonical === input3 || existing2 && sameIdentity2(existing2, stat) || publication?.existing && sameIdentity2(publication.existing, stat)) return;
+    if (canonical === output2 || canonical === input3 || existing2 && sameZipIdentity(existing2, stat) || publication?.existing && sameZipIdentity(publication.existing, stat)) return;
     const symlink = parsed.storeLinks && stat.type === "symlink";
     const fifoSource = (stat.mode & 61440) === 4096;
     if (fifoSource && !parsed.fifo || stat.type !== "file" && stat.type !== "directory" && !symlink && !fifoSource) {
@@ -30057,13 +30113,13 @@ async function prepare(scope, parsed, budget, log, host2) {
 `);
       return;
     }
-    if ((existing2 || publication?.existing) && !hasIdentity(stat)) fail("cannot exclude archive aliases when source backing identity is unknown");
     const directory2 = stat.type === "directory";
+    if ((existing2 || publication?.existing) && !directory2 && !hasZipIdentity(stat)) fail("cannot exclude archive aliases when source backing identity is unknown");
     if (directory2 && name2 && !name2.endsWith("/")) name2 += "/";
     const dateIncluded = zipDateMatches(new Date(stat.mtimeMs), parsed.fromDate, parsed.beforeDate);
     const nameIncluded = (dateIncluded || parsed.entryComments) && await filterName(name2, selection, parsed.includes.length) && (!recursiveSelection || await recursiveSelection.matches(name2, true));
     const included = dateIncluded && nameIncluded;
-    if (logStat && included && (!hasIdentity(stat) || sameIdentity2(logStat, stat))) {
+    if (logStat && included && (!hasZipIdentity(stat) || sameZipIdentity(logStat, stat))) {
       if (log) log.failed = true;
       throw new ZipFailure(16, "Invalid command arguments", "ZIP log may not alias a selected source");
     }
@@ -30143,7 +30199,7 @@ async function prepare(scope, parsed, budget, log, host2) {
       }
     }
     if (directory2 && !storedName && (parsed.recursive || parsed.recursivePatterns)) {
-      if (ancestors.some((ancestor) => ancestor.path === canonical || sameIdentity2(ancestor.stat, stat))) fail(`directory cycle while archiving: ${source2}`);
+      if (ancestors.some((ancestor) => ancestor.path === canonical || sameZipIdentity(ancestor.stat, stat))) fail(`directory cycle while archiving: ${source2}`);
       ancestors.push({ path: canonical, stat });
       try {
         const children = await scope.operation(() => context2.fs.readdir(path, { signal: context2.signal, maxEntries: limits.maxMembers - visits }));