@rudderhq/server 0.7.18 → 0.7.19-canary.0

package/dist/home-paths.js

@@ -5,6 +5,7 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { resolveStoredOrDerivedAgentWorkspaceKey } from "./agent-workspace-key.js";
+import { syncDirectory, syncFileHandle } from "./file-system-durability.js";
 const DEFAULT_INSTANCE_ID = "default";
 const INSTANCE_ID_RE = /^[a-zA-Z0-9_-]+$/;
 const FRIENDLY_PATH_SEGMENT_RE = /[^a-zA-Z0-9._-]+/g;
@@ -13,8 +14,23 @@ const EXECUTABLE_MODE_BITS = 0o111;
 const MIGRATION_BACKUP_DIR_NAME = ".rudder-migration-backups";
 const WORKSPACE_PERMISSION_ERROR_CODES = new Set(["EACCES", "EPERM", "EROFS"]);
 const ORGANIZATION_WORKSPACE_MAP_FILE = ".rudder-organizations.json";
+const ORGANIZATION_WORKSPACE_MAP_LOCK = ".rudder-organizations.lock";
+const ORGANIZATION_WORKSPACE_MAP_LOCK_OWNER_PREFIX = ".rudder-lock-owner-";
+const ORGANIZATION_WORKSPACE_MAP_LOCK_ACQUIRE_PREFIX = ".rudder-organizations.lock.acquire-";
+const ORGANIZATION_WORKSPACE_MAP_LOCK_RECOVERY_PREFIX = ".rudder-organizations.lock.recovered-";
+const ORGANIZATION_WORKSPACE_MAP_LOCK_KIND = "rudder-organization-workspace-map-lock";
+const ORGANIZATION_WORKSPACE_MAP_RECLAIM_PREFIX = ".rudder-lock-reclaim-";
+const ORGANIZATION_WORKSPACE_IDENTITY_FILE = ".rudder-workspace.json";
+const ORGANIZATION_WORKSPACE_MIGRATION_FILE = ".rudder-workspace-migrations.json";
+const ORGANIZATION_WORKSPACE_MAP_LOCK_TIMEOUT_MS = 10_000;
+const ORGANIZATION_WORKSPACE_MAP_STALE_LOCK_MS = 60_000;
+const ORGANIZATION_WORKSPACE_MAP_LOCK_TARGET_EXISTS_CODES = new Set(["EEXIST", "ENOTEMPTY", "EISDIR"]);
 const RESERVED_ORGANIZATION_WORKSPACE_NAMES = new Set([
     ORGANIZATION_WORKSPACE_MAP_FILE,
+    ORGANIZATION_WORKSPACE_MAP_LOCK,
+    MIGRATION_BACKUP_DIR_NAME,
+    "organizations",
+    "projects",
     ".rudder",
     "backups",
     "data",
@@ -83,7 +99,9 @@ function resolveAgentWorkspacePathSegment(agent) {
 export function resolveOrganizationWorkspaceRoot(orgId) {
     const normalizedOrgId = resolveOrganizationStorageKey(orgId);
     if (usesFriendlyOrganizationWorkspaceHome()) {
-        return path.resolve(resolveOrganizationWorkspaceHomeDir(), readOrganizationWorkspaceFolderName(orgId) ?? normalizedOrgId);
+        const mappedFolderName = readOrganizationWorkspaceFolderName(orgId);
+        const folderName = mappedFolderName ?? sanitizeOrganizationWorkspaceFolderName(normalizedOrgId, normalizedOrgId);
+        return path.resolve(resolveOrganizationWorkspaceHomeDir(), folderName);
     }
     return path.resolve(resolveOrganizationWorkspaceHomeDir(), normalizedOrgId, "workspaces");
 }
@@ -155,11 +173,14 @@ export function resolveManagedOrganizationCodebaseDir(input) {
     return path.resolve(resolveOrganizationWorkspaceRoot(input.orgId), "codebase", sanitizeFriendlyPathSegment(input.repoName, "_default"));
 }
 export async function ensureOrganizationWorkspaceLayout(org) {
+    return await updateOrganizationWorkspaceMap(() => ensureOrganizationWorkspaceLayoutUnlocked(org));
+}
+async function ensureOrganizationWorkspaceLayoutUnlocked(org) {
     const orgId = typeof org === "string" ? org : org.id;
-    await migrateOrganizationStorageRoot(orgId);
+    await migrateOrganizationStorageRootUnlocked(orgId);
     let mappingState = null;
     if (typeof org !== "string") {
-        mappingState = await ensureOrganizationWorkspaceMapping(org);
+        mappingState = await ensureOrganizationWorkspaceMappingUnlocked(org);
     }
     else if (usesFriendlyOrganizationWorkspaceHome()) {
         const map = await readOrganizationWorkspaceMapFile();
@@ -168,20 +189,24 @@ export async function ensureOrganizationWorkspaceLayout(org) {
             mappingState = { record: existing, created: false };
         }
     }
-    await migrateOrganizationWorkspaceRoot(orgId, {
+    const root = resolveOrganizationWorkspaceRoot(orgId);
+    await assertOrganizationWorkspaceRootIsOwned(root);
+    await migrateOrganizationWorkspaceRootUnlocked(orgId, {
         failIfMappedFolderMissing: Boolean(mappingState && !mappingState.created),
     });
-    const root = resolveOrganizationWorkspaceRoot(orgId);
+    await assertOrganizationWorkspaceRootIsOwned(root);
     const agentsDir = resolveOrganizationAgentsDir(orgId);
     const skillsDir = resolveOrganizationSkillsDir(orgId);
     const projectsDir = resolveOrganizationProjectsDir(orgId);
     try {
+        await fs.mkdir(root, { recursive: true });
+        await assertOrganizationWorkspaceRootIsOwned(root);
         await Promise.all([
-            fs.mkdir(root, { recursive: true }),
             fs.mkdir(agentsDir, { recursive: true }),
             fs.mkdir(skillsDir, { recursive: true }),
             fs.mkdir(projectsDir, { recursive: true }),
         ]);
+        await ensureOrganizationWorkspaceIdentity(root, orgId);
     }
     catch (error) {
         if (isPermissionError(error)) {
@@ -196,52 +221,330 @@ export async function ensureOrganizationWorkspaceLayout(org) {
     }
     return { root, agentsDir, skillsDir, projectsDir };
 }
-async function ensureOrganizationWorkspaceMapping(org) {
+async function ensureOrganizationWorkspaceMappingUnlocked(org) {
     if (!usesFriendlyOrganizationWorkspaceHome())
         return null;
-    return await updateOrganizationWorkspaceMap(async () => {
-        const orgId = validatePathSegment(org.id, "org id");
-        const homeDir = resolveOrganizationWorkspaceHomeDir();
-        const mapPath = resolveOrganizationWorkspaceMapPath();
-        await fs.mkdir(homeDir, { recursive: true });
-        const now = new Date().toISOString();
-        const mapState = await readOrganizationWorkspaceMapFileState();
-        const map = mapState.map;
-        const existing = findOrganizationWorkspaceMapRecord(map, orgId);
-        if (existing) {
-            existing.orgName = org.name ?? existing.orgName ?? null;
-            existing.updatedAt = now;
-            await writeOrganizationWorkspaceMapFile(mapPath, map);
-            return { record: existing, created: false };
-        }
-        const folderName = await allocateOrganizationWorkspaceFolderName({
-            homeDir,
-            map,
-            orgId,
-            orgName: org.name,
-            orgUrlKey: org.urlKey,
-            allowExistingBaseDirectory: !mapState.exists,
-        });
-        const record = {
-            instanceId: resolveRudderInstanceId(),
-            orgId,
-            folderName,
-            orgName: org.name ?? null,
-            createdAt: now,
-            updatedAt: now,
-        };
-        map.organizations.push(record);
+    const orgId = validatePathSegment(org.id, "org id");
+    const homeDir = resolveOrganizationWorkspaceHomeDir();
+    const mapPath = resolveOrganizationWorkspaceMapPath();
+    await fs.mkdir(homeDir, { recursive: true });
+    const now = new Date().toISOString();
+    const mapState = await readOrganizationWorkspaceMapFileState();
+    const map = mapState.map;
+    const existing = findOrganizationWorkspaceMapRecord(map, orgId);
+    if (existing) {
+        existing.orgName = org.name ?? existing.orgName ?? null;
+        existing.updatedAt = now;
         await writeOrganizationWorkspaceMapFile(mapPath, map);
-        return { record, created: true };
+        return { record: existing, created: false };
+    }
+    const folderName = await allocateOrganizationWorkspaceFolderName({
+        homeDir,
+        map,
+        orgId,
+        orgName: org.name,
+        orgUrlKey: org.urlKey,
     });
+    const folderPath = path.resolve(homeDir, folderName);
+    // Materialize the identity before publishing the map record so a crash can
+    // reclaim a directory that was created just before the map write.
+    await fs.mkdir(folderPath, { recursive: true });
+    await ensureOrganizationWorkspaceIdentity(folderPath, orgId);
+    const record = {
+        instanceId: resolveRudderInstanceId(),
+        orgId,
+        folderName,
+        orgName: org.name ?? null,
+        createdAt: now,
+        updatedAt: now,
+    };
+    map.organizations.push(record);
+    await writeOrganizationWorkspaceMapFile(mapPath, map);
+    return { record, created: true };
 }
 async function updateOrganizationWorkspaceMap(fn) {
     const previous = organizationWorkspaceMapUpdateQueue.catch(() => { });
-    const current = previous.then(fn, fn);
+    const current = previous.then(() => withOrganizationWorkspaceMapLock(fn), () => withOrganizationWorkspaceMapLock(fn));
     organizationWorkspaceMapUpdateQueue = current.catch(() => { });
     return await current;
 }
+async function withOrganizationWorkspaceMapLock(fn) {
+    const lockPath = path.resolve(resolveOrganizationWorkspaceHomeDir(), ORGANIZATION_WORKSPACE_MAP_LOCK);
+    const lockParentPath = path.dirname(lockPath);
+    const startedAt = Date.now();
+    const token = randomUUID();
+    const ownerFileName = `${ORGANIZATION_WORKSPACE_MAP_LOCK_OWNER_PREFIX}${token}.json`;
+    const acquisitionPath = path.join(lockParentPath, `${ORGANIZATION_WORKSPACE_MAP_LOCK_ACQUIRE_PREFIX}${token}`);
+    const acquisitionOwnerPath = path.join(acquisitionPath, ownerFileName);
+    let acquisitionCreated = false;
+    let lockAcquired = false;
+    await fs.mkdir(lockParentPath, { recursive: true });
+    try {
+        // Build a complete owner directory before the final rename. This keeps an
+        // acquired lock from ever being observable without its owner record.
+        await fs.mkdir(acquisitionPath, { mode: 0o700 });
+        acquisitionCreated = true;
+        const owner = {
+            kind: ORGANIZATION_WORKSPACE_MAP_LOCK_KIND,
+            version: 1,
+            token,
+            pid: process.pid,
+            hostname: os.hostname(),
+            createdAt: new Date().toISOString(),
+        };
+        const handle = await fs.open(acquisitionOwnerPath, "wx", 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify(owner, null, 2)}\n`, "utf8");
+            await syncFileHandle(handle);
+        }
+        finally {
+            await handle.close();
+        }
+        await syncDirectory(acquisitionPath);
+        while (true) {
+            if (Date.now() - startedAt >= ORGANIZATION_WORKSPACE_MAP_LOCK_TIMEOUT_MS) {
+                throw Object.assign(new Error(`Timed out waiting for the organization workspace mapping lock at ${lockPath}.`), { code: "RUDDER_WORKSPACE_MAP_LOCK_TIMEOUT" });
+            }
+            const existingLock = await lstatIfExists(lockPath);
+            if (existingLock) {
+                const existingOwner = await readOrganizationWorkspaceMapLockOwner(lockPath);
+                if (!existingOwner) {
+                    const entries = await fs.readdir(lockPath).catch(() => []);
+                    if (entries.length === 0
+                        && await quarantineStaleEmptyOrganizationWorkspaceMapLock(lockPath)) {
+                        continue;
+                    }
+                    if (entries.length === 0 && Date.now() - startedAt < ORGANIZATION_WORKSPACE_MAP_LOCK_TIMEOUT_MS) {
+                        await new Promise((resolve) => setTimeout(resolve, 25));
+                        continue;
+                    }
+                    throw organizationWorkspaceMapLockCollision(lockPath);
+                }
+                const ownerAgeMs = Date.now() - Date.parse(existingOwner.createdAt);
+                if (existingOwner.hostname === os.hostname()
+                    && ownerAgeMs > ORGANIZATION_WORKSPACE_MAP_STALE_LOCK_MS
+                    && !isProcessAlive(existingOwner.pid)) {
+                    await reclaimStaleOrganizationWorkspaceMapLock(lockPath, existingOwner);
+                    continue;
+                }
+                await new Promise((resolve) => setTimeout(resolve, 25));
+                continue;
+            }
+            try {
+                await fs.rename(acquisitionPath, lockPath);
+                lockAcquired = true;
+                break;
+            }
+            catch (error) {
+                if (!ORGANIZATION_WORKSPACE_MAP_LOCK_TARGET_EXISTS_CODES.has(errorCode(error) ?? ""))
+                    throw error;
+                // Another process appeared between the existence probe and rename;
+                // inspect it through the non-destructive path on the next iteration.
+            }
+        }
+        return await fn();
+    }
+    finally {
+        if (lockAcquired) {
+            await releaseOrganizationWorkspaceMapLock(lockPath, token);
+        }
+        else if (acquisitionCreated) {
+            await fs.rm(acquisitionPath, { recursive: true, force: true });
+        }
+    }
+}
+function organizationWorkspaceMapLockCollision(lockPath) {
+    return Object.assign(new Error(`Refusing to replace the unrecognized organization workspace mapping lock path at ${lockPath}. `
+        + "Rename or restore that directory before starting Rudder."), { code: "RUDDER_WORKSPACE_MAP_LOCK_COLLISION" });
+}
+async function quarantineStaleEmptyOrganizationWorkspaceMapLock(lockPath) {
+    const lockStat = await lstatIfExists(lockPath);
+    if (!lockStat
+        || !lockStat.isDirectory()
+        || lockStat.isSymbolicLink()
+        || (lockStat.mode & 0o777) !== 0o700
+        || Date.now() - lockStat.mtimeMs <= ORGANIZATION_WORKSPACE_MAP_STALE_LOCK_MS)
+        return false;
+    const entries = await fs.readdir(lockPath).catch((error) => {
+        if (errorCode(error) === "ENOENT")
+            return [];
+        throw error;
+    });
+    if (entries.length > 0)
+        return false;
+    const quarantinePath = path.join(path.dirname(lockPath), `${ORGANIZATION_WORKSPACE_MAP_LOCK_RECOVERY_PREFIX}${randomUUID()}`);
+    try {
+        await fs.rename(lockPath, quarantinePath);
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return true;
+        throw error;
+    }
+    await syncDirectory(path.dirname(lockPath));
+    return true;
+}
+async function reclaimStaleOrganizationWorkspaceMapLock(lockPath, observedOwner) {
+    const claim = {
+        version: 1,
+        token: randomUUID(),
+        ownerToken: observedOwner.token,
+        pid: process.pid,
+        hostname: os.hostname(),
+        createdAt: new Date().toISOString(),
+    };
+    const reclaimPath = path.join(lockPath, `${ORGANIZATION_WORKSPACE_MAP_RECLAIM_PREFIX}${claim.token}.json`);
+    let handle;
+    try {
+        handle = await fs.open(reclaimPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return;
+        throw error;
+    }
+    try {
+        await handle.writeFile(`${JSON.stringify(claim)}\n`, "utf8");
+        await syncFileHandle(handle);
+    }
+    finally {
+        await handle.close();
+    }
+    // Let concurrently-starting reclaimers publish before electing the oldest live claim.
+    await new Promise((resolve) => setTimeout(resolve, 25));
+    const claims = await readOrganizationWorkspaceMapReclaimClaims(lockPath);
+    await Promise.all(claims.map(async (candidate) => {
+        if (candidate.hostname === os.hostname()
+            && Date.now() - Date.parse(candidate.createdAt) > ORGANIZATION_WORKSPACE_MAP_STALE_LOCK_MS
+            && !isProcessAlive(candidate.pid)) {
+            await fs.rm(candidate.path, { force: true });
+        }
+    }));
+    const liveClaims = (await readOrganizationWorkspaceMapReclaimClaims(lockPath))
+        .filter((candidate) => candidate.ownerToken === observedOwner.token)
+        .sort((left, right) => left.createdAt.localeCompare(right.createdAt) || left.token.localeCompare(right.token));
+    if (liveClaims[0]?.token !== claim.token) {
+        await fs.rm(reclaimPath, { force: true });
+        return;
+    }
+    const currentOwner = await readOrganizationWorkspaceMapLockOwner(lockPath);
+    const stillStale = currentOwner?.token === observedOwner.token
+        && currentOwner.hostname === os.hostname()
+        && Date.now() - Date.parse(currentOwner.createdAt) > ORGANIZATION_WORKSPACE_MAP_STALE_LOCK_MS
+        && !isProcessAlive(currentOwner.pid);
+    if (!stillStale) {
+        await fs.rm(reclaimPath, { force: true });
+        return;
+    }
+    const tombstonePath = `${lockPath}.reclaimed-${observedOwner.token}-${randomUUID()}`;
+    try {
+        await fs.rename(lockPath, tombstonePath);
+    }
+    catch (error) {
+        if (errorCode(error) !== "ENOENT")
+            throw error;
+        return;
+    }
+    // Only the positively identified directory captured by the atomic rename is removed.
+    await fs.rm(tombstonePath, { recursive: true, force: true });
+}
+async function readOrganizationWorkspaceMapReclaimClaims(lockPath) {
+    try {
+        const entries = await fs.readdir(lockPath, { withFileTypes: true });
+        const claims = await Promise.all(entries.flatMap((entry) => entry.isFile()
+            && entry.name.startsWith(ORGANIZATION_WORKSPACE_MAP_RECLAIM_PREFIX)
+            && entry.name.endsWith(".json")
+            ? [readOrganizationWorkspaceMapReclaimClaim(path.join(lockPath, entry.name), entry.name)]
+            : []));
+        return claims.flatMap((claim) => claim ? [claim] : []);
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function readOrganizationWorkspaceMapReclaimClaim(claimPath, fileName) {
+    try {
+        const claim = JSON.parse(await fs.readFile(claimPath, "utf8"));
+        if (claim.version !== 1
+            || typeof claim.token !== "string"
+            || fileName !== `${ORGANIZATION_WORKSPACE_MAP_RECLAIM_PREFIX}${claim.token}.json`
+            || typeof claim.ownerToken !== "string"
+            || !Number.isSafeInteger(claim.pid)
+            || (claim.pid ?? 0) <= 0
+            || typeof claim.hostname !== "string"
+            || typeof claim.createdAt !== "string"
+            || !Number.isFinite(Date.parse(claim.createdAt)))
+            return null;
+        return { ...claim, path: claimPath };
+    }
+    catch {
+        return null;
+    }
+}
+async function releaseOrganizationWorkspaceMapLock(lockPath, token) {
+    const currentOwner = await readOrganizationWorkspaceMapLockOwner(lockPath);
+    if (currentOwner?.token !== token)
+        return;
+    const tombstonePath = `${lockPath}.released-${token}-${randomUUID()}`;
+    try {
+        await fs.rename(lockPath, tombstonePath);
+    }
+    catch (error) {
+        if (errorCode(error) !== "ENOENT")
+            throw error;
+        return;
+    }
+    await fs.rm(tombstonePath, { recursive: true, force: true });
+}
+async function readOrganizationWorkspaceMapLockOwner(lockPath) {
+    try {
+        const entries = await fs.readdir(lockPath, { withFileTypes: true });
+        const ownerEntries = entries.filter((entry) => entry.isFile()
+            && entry.name.startsWith(ORGANIZATION_WORKSPACE_MAP_LOCK_OWNER_PREFIX)
+            && entry.name.endsWith(".json"));
+        if (ownerEntries.length !== 1)
+            return null;
+        if (entries.some((entry) => entry.name !== ownerEntries[0].name
+            && !(entry.isFile()
+                && entry.name.startsWith(ORGANIZATION_WORKSPACE_MAP_RECLAIM_PREFIX)
+                && entry.name.endsWith(".json"))))
+            return null;
+        const fileName = ownerEntries[0].name;
+        if (!fileName.startsWith(ORGANIZATION_WORKSPACE_MAP_LOCK_OWNER_PREFIX) || !fileName.endsWith(".json")) {
+            return null;
+        }
+        const owner = JSON.parse(await fs.readFile(path.join(lockPath, fileName), "utf8"));
+        if (owner.kind !== ORGANIZATION_WORKSPACE_MAP_LOCK_KIND
+            || owner.version !== 1
+            || typeof owner.token !== "string"
+            || fileName !== `${ORGANIZATION_WORKSPACE_MAP_LOCK_OWNER_PREFIX}${owner.token}.json`
+            || !Number.isSafeInteger(owner.pid)
+            || (owner.pid ?? 0) <= 0
+            || typeof owner.hostname !== "string"
+            || typeof owner.createdAt !== "string"
+            || !Number.isFinite(Date.parse(owner.createdAt)))
+            return null;
+        return owner;
+    }
+    catch {
+        return null;
+    }
+}
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return errorCode(error) !== "ESRCH";
+    }
+}
 export async function migrateOrganizationStorageRoot(orgId) {
+    return await updateOrganizationWorkspaceMap(() => migrateOrganizationStorageRootUnlocked(orgId));
+}
+async function migrateOrganizationStorageRootUnlocked(orgId) {
     const canonicalRootPath = resolveOrganizationRoot(orgId);
     const legacyRootPath = resolveLegacyOrganizationRoot(orgId);
     if (canonicalRootPath === legacyRootPath) {
@@ -316,6 +619,9 @@ export async function migrateOrganizationStorageRoot(orgId) {
     };
 }
 export async function migrateOrganizationWorkspaceRoot(orgId, options) {
+    return await updateOrganizationWorkspaceMap(() => migrateOrganizationWorkspaceRootUnlocked(orgId, options));
+}
+async function migrateOrganizationWorkspaceRootUnlocked(orgId, options) {
     const canonicalRootPath = resolveOrganizationWorkspaceRoot(orgId);
     const legacyRootPath = resolveLegacyOrganizationWorkspaceRoot(orgId);
     const previousDocumentsRootPath = resolvePreviousDocumentsOrganizationWorkspaceRoot(orgId);
@@ -337,24 +643,53 @@ export async function migrateOrganizationWorkspaceRoot(orgId, options) {
     for (const candidateLegacyRootPath of legacyRootPaths) {
         firstLegacyRootPath = firstLegacyRootPath || candidateLegacyRootPath;
         const legacyExists = await directoryExists(candidateLegacyRootPath);
-        if (!legacyExists)
+        if (!legacyExists) {
+            if (await directoryExists(canonicalRootPath)
+                && await workspaceIdentityMatches(canonicalRootPath, orgId)
+                && await workspaceMigrationIncludesAlias(canonicalRootPath, candidateLegacyRootPath)) {
+                await fs.mkdir(path.dirname(candidateLegacyRootPath), { recursive: true });
+                await createDirectoryCompatibilityAlias(candidateLegacyRootPath, canonicalRootPath);
+                migrated = true;
+                migratedFromRootPath = candidateLegacyRootPath;
+            }
+            continue;
+        }
+        if (await pathsReferenceSameDirectory(candidateLegacyRootPath, canonicalRootPath))
             continue;
         const canonicalExists = await directoryExists(canonicalRootPath);
         try {
             if (canonicalExists) {
-                await assertCanMergeDirectoryContents(candidateLegacyRootPath, canonicalRootPath);
-                const retainedDuplicates = await mergeDirectoryContents(candidateLegacyRootPath, canonicalRootPath);
-                if (retainedDuplicates)
-                    await archiveRetainedMigrationSource(candidateLegacyRootPath);
+                await assertWorkspaceRootMoveCanBeAtomic(candidateLegacyRootPath, canonicalRootPath);
+                await ensureOrganizationWorkspaceIdentity(canonicalRootPath, orgId);
+                await ensureOrganizationWorkspaceIdentity(candidateLegacyRootPath, orgId);
+                const compatibilityAliases = new Set([
+                    ...(await readWorkspaceMigrationAliases(canonicalRootPath)),
+                    ...(await readWorkspaceMigrationAliases(candidateLegacyRootPath)),
+                    path.resolve(candidateLegacyRootPath),
+                ]);
+                // Preserve the legacy root inode while merging. A Run may already have
+                // a cwd anywhere below it; renaming this root to the canonical path
+                // keeps that cwd attached to the live workspace after the rekey.
+                await writeWorkspaceMigrationState(candidateLegacyRootPath, [...compatibilityAliases]);
+                await assertCanMergeDirectoryContents(canonicalRootPath, candidateLegacyRootPath);
+                const retainedDuplicates = await mergeDirectoryContents(canonicalRootPath, candidateLegacyRootPath);
+                if (retainedDuplicates) {
+                    await archiveRetainedMigrationSource(canonicalRootPath, path.dirname(candidateLegacyRootPath));
+                }
                 else
-                    await fs.rmdir(candidateLegacyRootPath);
+                    await fs.rmdir(canonicalRootPath);
+                await moveWorkspacePathWithCompatibilityAlias(candidateLegacyRootPath, canonicalRootPath);
                 migrated = true;
                 migratedFromRootPath = candidateLegacyRootPath;
                 mergedIntoExistingTarget = true;
                 continue;
             }
             await fs.mkdir(path.dirname(canonicalRootPath), { recursive: true });
-            await movePath(candidateLegacyRootPath, canonicalRootPath);
+            await assertWorkspaceRootMoveCanBeAtomic(candidateLegacyRootPath, canonicalRootPath);
+            // The identity moves with the directory and makes a post-rename crash repairable.
+            await ensureOrganizationWorkspaceIdentity(candidateLegacyRootPath, orgId);
+            await recordWorkspaceCompatibilityAlias(candidateLegacyRootPath, candidateLegacyRootPath);
+            await moveWorkspacePathWithCompatibilityAlias(candidateLegacyRootPath, canonicalRootPath);
             migrated = true;
             migratedFromRootPath = candidateLegacyRootPath;
         }
@@ -490,33 +825,49 @@ function sanitizeFriendlyPathSegment(value, fallback = "_default") {
     return sanitized || fallback;
 }
 function sanitizeOrganizationWorkspaceFolderName(value, fallback) {
+    const safeFallback = sanitizeFriendlyPathSegment(fallback, "_default")
+        .replace(/[.]+$/g, "")
+        .toLowerCase();
+    const normalizedFallback = RESERVED_ORGANIZATION_WORKSPACE_NAMES.has(safeFallback)
+        ? `organization-${safeFallback}`
+        : safeFallback;
     const sanitized = sanitizeFriendlyPathSegment(value, fallback)
         .replace(/[.]+$/g, "")
         .toLowerCase();
     const normalized = sanitized && !RESERVED_ORGANIZATION_WORKSPACE_NAMES.has(sanitized)
         ? sanitized
-        : fallback;
-    return normalized || fallback;
+        : normalizedFallback;
+    return normalized || normalizedFallback;
+}
+function isOrganizationWorkspaceMapInternalDirectoryName(name) {
+    return name === ORGANIZATION_WORKSPACE_MAP_LOCK
+        || name.startsWith(`${ORGANIZATION_WORKSPACE_MAP_LOCK}.`)
+        || name.startsWith(ORGANIZATION_WORKSPACE_MAP_LOCK_ACQUIRE_PREFIX)
+        || name.startsWith(ORGANIZATION_WORKSPACE_MAP_LOCK_RECOVERY_PREFIX);
+}
+function isOrganizationWorkspaceMapRecord(value) {
+    return typeof value === "object"
+        && value !== null
+        && typeof value.instanceId === "string"
+        && typeof value.orgId === "string"
+        && typeof value.folderName === "string"
+        && typeof value.createdAt === "string"
+        && typeof value.updatedAt === "string";
 }
 async function readOrganizationWorkspaceMapFileState() {
     const mapPath = resolveOrganizationWorkspaceMapPath();
     try {
         const raw = await fs.readFile(mapPath, "utf8");
         const parsed = JSON.parse(raw);
-        if (parsed.version !== 1 || !Array.isArray(parsed.organizations)) {
+        if (parsed.version !== 1 || !Array.isArray(parsed.organizations)
+            || !parsed.organizations.every(isOrganizationWorkspaceMapRecord)) {
             throw new Error(`Invalid organization workspace mapping file at ${mapPath}. Restore the mapping file or restore organizations from workspace backups before starting Rudder.`);
         }
         return {
             exists: true,
             map: {
                 version: 1,
-                organizations: parsed.organizations.filter((entry) => typeof entry === "object"
-                    && entry !== null
-                    && typeof entry.instanceId === "string"
-                    && typeof entry.orgId === "string"
-                    && typeof entry.folderName === "string"
-                    && typeof entry.createdAt === "string"
-                    && typeof entry.updatedAt === "string"),
+                organizations: parsed.organizations,
             },
         };
     }
@@ -547,47 +898,215 @@ function findOrganizationWorkspaceMapRecord(map, orgId) {
 function readOrganizationWorkspaceFolderName(orgId) {
     if (!usesFriendlyOrganizationWorkspaceHome())
         return null;
+    const mapPath = resolveOrganizationWorkspaceMapPath();
+    let raw;
     try {
-        const raw = fsSync.readFileSync(resolveOrganizationWorkspaceMapPath(), "utf8");
-        const parsed = JSON.parse(raw);
-        if (parsed.version !== 1 || !Array.isArray(parsed.organizations))
+        raw = fsSync.readFileSync(mapPath, "utf8");
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
             return null;
-        const record = parsed.organizations.find((entry) => typeof entry === "object"
-            && entry !== null
-            && entry.instanceId === resolveRudderInstanceId()
-            && entry.orgId === orgId
-            && typeof entry.folderName === "string");
-        return record?.folderName ?? null;
+        throw new Error(`Rudder could not read the organization workspace mapping at ${mapPath}.`, { cause: error });
     }
-    catch {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`Invalid organization workspace mapping file at ${mapPath}.`, { cause: error });
+    }
+    if (parsed.version !== 1 || !Array.isArray(parsed.organizations)
+        || !parsed.organizations.every(isOrganizationWorkspaceMapRecord)) {
+        throw new Error(`Invalid organization workspace mapping file at ${mapPath}.`);
+    }
+    const record = parsed.organizations.find((entry) => entry.instanceId === resolveRudderInstanceId() && entry.orgId === orgId);
+    if (!record)
         return null;
+    try {
+        if (typeof record.folderName !== "string") {
+            throw new Error("Organization workspace folder mapping must contain a folder name.");
+        }
+        const folderName = validatePathSegment(record.folderName, "organization workspace folder");
+        if (folderName !== record.folderName) {
+            throw new Error("Organization workspace folder mapping must not contain leading or trailing whitespace.");
+        }
+        if (RESERVED_ORGANIZATION_WORKSPACE_NAMES.has(folderName.toLowerCase())) {
+            throw new Error(`Organization workspace folder mapping uses reserved folder '${folderName}'.`);
+        }
+        return folderName;
+    }
+    catch (error) {
+        const detail = error instanceof Error && error.message ? ` ${error.message}` : "";
+        throw new Error(`Invalid organization workspace folder mapping for '${orgId}'.${detail}`, { cause: error });
     }
 }
 async function writeOrganizationWorkspaceMapFile(mapPath, map) {
     const tempPath = `${mapPath}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
     await fs.mkdir(path.dirname(mapPath), { recursive: true });
-    await fs.writeFile(tempPath, `${JSON.stringify(map, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    const handle = await fs.open(tempPath, "wx", 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(map, null, 2)}\n`, "utf8");
+        await syncFileHandle(handle);
+    }
+    finally {
+        await handle.close();
+    }
     await fs.rename(tempPath, mapPath);
+    await syncDirectory(path.dirname(mapPath));
+}
+async function ensureOrganizationWorkspaceIdentity(root, orgId) {
+    const identityPath = path.join(root, ORGANIZATION_WORKSPACE_IDENTITY_FILE);
+    const expectedOrgId = validatePathSegment(orgId, "org id");
+    try {
+        const existing = JSON.parse(await fs.readFile(identityPath, "utf8"));
+        if (existing.orgId !== expectedOrgId) {
+            throw new Error(`Organization workspace identity mismatch at ${identityPath}.`);
+        }
+        return;
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT") {
+            // Continue below and publish a fresh identity atomically.
+        }
+        else if (error instanceof SyntaxError) {
+            const corruptPath = `${identityPath}.corrupt-${randomUUID()}`;
+            await fs.rename(identityPath, corruptPath);
+            await syncDirectory(root);
+        }
+        else {
+            throw error;
+        }
+    }
+    const tempPath = `${identityPath}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        const handle = await fs.open(tempPath, "wx", 0o600);
+        try {
+            await handle.writeFile(`${JSON.stringify({ version: 1, orgId: expectedOrgId }, null, 2)}\n`, "utf8");
+            await syncFileHandle(handle);
+        }
+        finally {
+            await handle.close();
+        }
+        await fs.rename(tempPath, identityPath);
+        await syncDirectory(root);
+    }
+    catch (error) {
+        if (errorCode(error) !== "EEXIST" || !(await workspaceIdentityMatches(root, expectedOrgId))) {
+            throw error;
+        }
+    }
+    finally {
+        await fs.rm(tempPath, { force: true }).catch(() => undefined);
+    }
+}
+async function workspaceIdentityMatches(root, orgId) {
+    try {
+        const identity = JSON.parse(await fs.readFile(path.join(root, ORGANIZATION_WORKSPACE_IDENTITY_FILE), "utf8"));
+        return identity.orgId === validatePathSegment(orgId, "org id");
+    }
+    catch {
+        return false;
+    }
+}
+async function assertFriendlyWorkspaceRemovalOwnership(orgId, workspaceRootPath, map) {
+    if (!usesFriendlyOrganizationWorkspaceHome())
+        return;
+    const record = findOrganizationWorkspaceMapRecord(map, orgId);
+    if (record) {
+        const normalizedFolderName = record.folderName.toLowerCase();
+        const duplicate = map.organizations.find((entry) => entry.instanceId === resolveRudderInstanceId()
+            && entry.orgId !== orgId
+            && entry.folderName.toLowerCase() === normalizedFolderName);
+        if (duplicate) {
+            throw new Error([
+                `Refusing to remove organization workspace '${workspaceRootPath}'.`,
+                `The folder is also mapped to organization '${duplicate.orgId}'.`,
+            ].join(" "));
+        }
+    }
+    const existing = await pathExists(workspaceRootPath);
+    if (!existing)
+        return;
+    if (existing.isSymbolicLink() || !existing.isDirectory()) {
+        throw new Error(`Refusing to remove organization workspace '${workspaceRootPath}' because it is not a regular directory.`);
+    }
+    if (!await workspaceIdentityMatches(workspaceRootPath, orgId)) {
+        throw new Error(`Refusing to remove organization workspace '${workspaceRootPath}' because its identity does not match '${orgId}'.`);
+    }
+}
+async function recordWorkspaceCompatibilityAlias(root, aliasPath) {
+    const aliases = await readWorkspaceMigrationAliases(root);
+    const normalizedAliasPath = path.resolve(aliasPath);
+    if (aliases.includes(normalizedAliasPath))
+        return;
+    aliases.push(normalizedAliasPath);
+    await writeWorkspaceMigrationState(root, aliases);
+}
+async function readWorkspaceMigrationAliases(root) {
+    const migrationPath = path.join(root, ORGANIZATION_WORKSPACE_MIGRATION_FILE);
+    try {
+        const parsed = JSON.parse(await fs.readFile(migrationPath, "utf8"));
+        if (parsed.version !== 1 || !Array.isArray(parsed.compatibilityAliases)) {
+            throw new Error(`Invalid organization workspace migration state at ${migrationPath}.`);
+        }
+        return parsed.compatibilityAliases.filter((entry) => typeof entry === "string");
+    }
+    catch (error) {
+        if (errorCode(error) === "ENOENT")
+            return [];
+        throw error;
+    }
+}
+async function writeWorkspaceMigrationState(root, aliases) {
+    const migrationPath = path.join(root, ORGANIZATION_WORKSPACE_MIGRATION_FILE);
+    const state = {
+        version: 1,
+        compatibilityAliases: [...new Set(aliases.map((alias) => path.resolve(alias)))].sort(),
+    };
+    const tempPath = `${migrationPath}.${process.pid}.${randomUUID()}.tmp`;
+    const handle = await fs.open(tempPath, "wx", 0o600);
+    try {
+        await handle.writeFile(`${JSON.stringify(state, null, 2)}\n`, "utf8");
+        await syncFileHandle(handle);
+    }
+    finally {
+        await handle.close();
+    }
+    await fs.rename(tempPath, migrationPath);
+    await syncDirectory(root);
+}
+async function workspaceMigrationIncludesAlias(root, aliasPath) {
+    try {
+        const state = JSON.parse(await fs.readFile(path.join(root, ORGANIZATION_WORKSPACE_MIGRATION_FILE), "utf8"));
+        return state.version === 1
+            && Array.isArray(state.compatibilityAliases)
+            && state.compatibilityAliases.includes(path.resolve(aliasPath));
+    }
+    catch {
+        return false;
+    }
 }
 async function allocateOrganizationWorkspaceFolderName(input) {
     const fallback = resolveOrganizationStorageKey(input.orgId);
     const base = sanitizeOrganizationWorkspaceFolderName(input.orgName ?? input.orgUrlKey, fallback);
     const usedFolders = new Set(input.map.organizations
         .filter((entry) => entry.instanceId === resolveRudderInstanceId() && entry.orgId !== input.orgId)
-        .map((entry) => entry.folderName));
+        .map((entry) => entry.folderName.toLowerCase()));
     for (let attempt = 1; attempt < 10000; attempt += 1) {
         const folderName = attempt === 1 ? base : `${base}-${attempt}`;
-        if (usedFolders.has(folderName))
+        if (usedFolders.has(folderName.toLowerCase()))
             continue;
         const existing = await pathExists(path.resolve(input.homeDir, folderName));
         if (existing && !existing.isDirectory())
             continue;
-        if (existing && input.allowExistingBaseDirectory && folderName === base)
+        if (existing
+            && folderName === base
+            && await workspaceIdentityMatches(path.resolve(input.homeDir, folderName), input.orgId))
             return folderName;
         if (existing) {
             const owned = input.map.organizations.some((entry) => entry.instanceId === resolveRudderInstanceId()
                 && entry.orgId === input.orgId
-                && entry.folderName === folderName);
+                && entry.folderName.toLowerCase() === folderName.toLowerCase());
             if (!owned)
                 continue;
         }
@@ -596,22 +1115,38 @@ async function allocateOrganizationWorkspaceFolderName(input) {
     throw new Error("Unable to allocate organization workspace folder name");
 }
 export async function removeOrganizationStorage(orgId) {
-    const normalizedOrgId = validatePathSegment(orgId, "org id");
-    const organizationRootPath = resolveOrganizationRoot(normalizedOrgId);
-    const legacyOrganizationRootPath = resolveLegacyOrganizationRoot(normalizedOrgId);
-    const workspaceRootPath = resolveOrganizationWorkspaceRoot(normalizedOrgId);
-    const legacyProjectsRootPath = path.resolve(resolveRudderInstanceRoot(), "projects", normalizedOrgId);
-    const removeLegacyOrganizationRoot = legacyOrganizationRootPath === organizationRootPath
-        ? []
-        : [fs.rm(legacyOrganizationRootPath, { recursive: true, force: true })];
-    await Promise.all([
-        fs.rm(organizationRootPath, { recursive: true, force: true }),
-        fs.rm(workspaceRootPath, { recursive: true, force: true }),
-        ...removeLegacyOrganizationRoot,
-        // Best-effort cleanup for legacy pre-org-workspace managed project paths.
-        fs.rm(legacyProjectsRootPath, { recursive: true, force: true }),
-    ]);
-    return { organizationRootPath, legacyOrganizationRootPath, workspaceRootPath, legacyProjectsRootPath };
+    return await updateOrganizationWorkspaceMap(async () => {
+        const normalizedOrgId = validatePathSegment(orgId, "org id");
+        const organizationRootPath = resolveOrganizationRoot(normalizedOrgId);
+        const legacyOrganizationRootPath = resolveLegacyOrganizationRoot(normalizedOrgId);
+        const workspaceRootPath = resolveOrganizationWorkspaceRoot(normalizedOrgId);
+        const previousDocumentsWorkspaceRootPath = resolvePreviousDocumentsOrganizationWorkspaceRoot(normalizedOrgId);
+        const legacyProjectsRootPath = path.resolve(resolveRudderInstanceRoot(), "projects", normalizedOrgId);
+        const mapState = await readOrganizationWorkspaceMapFileState();
+        await assertFriendlyWorkspaceRemovalOwnership(normalizedOrgId, workspaceRootPath, mapState.map);
+        const pathsToRemove = new Set([
+            organizationRootPath,
+            workspaceRootPath,
+            legacyOrganizationRootPath,
+            previousDocumentsWorkspaceRootPath,
+            legacyProjectsRootPath,
+        ]);
+        await Promise.all([...pathsToRemove].map((targetPath) => fs.rm(targetPath, { recursive: true, force: true })));
+        const nextOrganizations = mapState.map.organizations.filter((entry) => !(entry.instanceId === resolveRudderInstanceId() && entry.orgId === normalizedOrgId));
+        if (nextOrganizations.length !== mapState.map.organizations.length) {
+            await writeOrganizationWorkspaceMapFile(resolveOrganizationWorkspaceMapPath(), {
+                ...mapState.map,
+                organizations: nextOrganizations,
+            });
+        }
+        return {
+            organizationRootPath,
+            legacyOrganizationRootPath,
+            workspaceRootPath,
+            previousDocumentsWorkspaceRootPath,
+            legacyProjectsRootPath,
+        };
+    });
 }
 async function listDirectoryNames(rootPath) {
     try {
@@ -679,6 +1214,17 @@ function formatOrganizationWorkspacePermissionMessage(input) {
         "Grant Rudder permission to access Documents, choose a writable folder with RUDDER_ORGANIZATION_WORKSPACE_HOME, or on Windows try running Rudder as administrator if the folder policy requires it.",
     ].join(" ");
 }
+async function assertOrganizationWorkspaceRootIsOwned(rootPath) {
+    const stat = await lstatIfExists(rootPath);
+    if (!stat)
+        return;
+    if (stat.isSymbolicLink()) {
+        throw new Error("The organization workspace root cannot be a symbolic link.");
+    }
+    if (!stat.isDirectory()) {
+        throw new Error("The organization workspace root must be a directory.");
+    }
+}
 async function lstatIfExists(targetPath) {
     try {
         return await fs.lstat(targetPath);
@@ -696,16 +1242,64 @@ async function movePath(sourcePath, targetPath) {
         return;
     }
     catch (error) {
-        if (errorCode(error) !== "EXDEV")
-            throw error;
+        if (errorCode(error) === "EXDEV") {
+            throw organizationWorkspaceCrossDeviceMigrationError(sourcePath, targetPath);
+        }
+        throw error;
+    }
+}
+async function pathsReferenceSameDirectory(first, second) {
+    try {
+        const [firstRealPath, secondRealPath] = await Promise.all([fs.realpath(first), fs.realpath(second)]);
+        return firstRealPath === secondRealPath;
+    }
+    catch {
+        return false;
+    }
+}
+async function createDirectoryCompatibilityAlias(aliasPath, targetPath) {
+    await fs.symlink(targetPath, aliasPath, process.platform === "win32" ? "junction" : "dir");
+    await syncDirectory(path.dirname(aliasPath));
+}
+function organizationWorkspaceCrossDeviceMigrationError(sourcePath, targetPath) {
+    return Object.assign(new Error(`Cannot atomically migrate organization workspace across filesystems from ${sourcePath} to ${targetPath}.`), { code: "RUDDER_WORKSPACE_CROSS_DEVICE_MIGRATION" });
+}
+async function assertWorkspaceRootMoveCanBeAtomic(sourcePath, targetPath) {
+    await assertPathMoveCanBeAtomic(sourcePath, targetPath);
+}
+async function assertPathMoveCanBeAtomic(sourcePath, targetPath) {
+    const sourceParentPath = path.dirname(sourcePath);
+    const targetParentPath = path.dirname(targetPath);
+    const [sourceParentStat, targetParentStat] = await Promise.all([
+        fs.stat(sourceParentPath),
+        fs.stat(targetParentPath),
+    ]);
+    const sourceVolumeRoot = path.parse(sourceParentPath).root;
+    const targetVolumeRoot = path.parse(targetParentPath).root;
+    const sameVolumeRoot = process.platform === "win32"
+        ? sourceVolumeRoot.toLowerCase() === targetVolumeRoot.toLowerCase()
+        : sourceVolumeRoot === targetVolumeRoot;
+    if (sourceParentStat.dev !== targetParentStat.dev || !sameVolumeRoot) {
+        throw organizationWorkspaceCrossDeviceMigrationError(sourcePath, targetPath);
+    }
+}
+async function moveWorkspacePathWithCompatibilityAlias(sourcePath, targetPath) {
+    try {
+        await fs.rename(sourcePath, targetPath);
+    }
+    catch (error) {
+        if (errorCode(error) === "EXDEV") {
+            throw organizationWorkspaceCrossDeviceMigrationError(sourcePath, targetPath);
+        }
+        throw error;
+    }
+    try {
+        await createDirectoryCompatibilityAlias(sourcePath, targetPath);
+    }
+    catch (error) {
+        await fs.rename(targetPath, sourcePath).catch(() => { });
+        throw error;
     }
-    await fs.cp(sourcePath, targetPath, {
-        recursive: true,
-        errorOnExist: true,
-        force: false,
-        preserveTimestamps: true,
-    });
-    await fs.rm(sourcePath, { recursive: true, force: false });
 }
 async function regularFilesHaveIdenticalContents(sourcePath, targetPath) {
     const sourceFile = await fs.open(sourcePath, "r");
@@ -745,8 +1339,8 @@ async function regularFilesHaveIdenticalContents(sourcePath, targetPath) {
         await sourceFile.close();
     }
 }
-async function archiveRetainedMigrationSource(sourceRoot) {
-    const backupHome = path.join(path.dirname(sourceRoot), MIGRATION_BACKUP_DIR_NAME);
+async function archiveRetainedMigrationSource(sourceRoot, backupParentPath = path.dirname(sourceRoot)) {
+    const backupHome = path.join(backupParentPath, MIGRATION_BACKUP_DIR_NAME);
     const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
     const backupPath = path.join(backupHome, `${path.basename(sourceRoot)}-${timestamp}-${randomUUID()}`);
     await fs.mkdir(backupHome, { recursive: true });
@@ -758,10 +1352,13 @@ async function mergeDirectoryContents(sourceRoot, targetRoot) {
     const entries = await fs.readdir(sourceRoot, { withFileTypes: true });
     let retainedDuplicates = false;
     for (const entry of entries) {
+        if (entry.name === ORGANIZATION_WORKSPACE_MIGRATION_FILE)
+            continue;
         const sourcePath = path.join(sourceRoot, entry.name);
         const targetPath = path.join(targetRoot, entry.name);
         const targetStat = await lstatIfExists(targetPath);
         if (!targetStat) {
+            await assertPathMoveCanBeAtomic(sourcePath, targetPath);
             await movePath(sourcePath, targetPath);
             continue;
         }
@@ -787,11 +1384,15 @@ async function mergeDirectoryContents(sourceRoot, targetRoot) {
 async function assertCanMergeDirectoryContents(sourceRoot, targetRoot) {
     const entries = await fs.readdir(sourceRoot, { withFileTypes: true });
     for (const entry of entries) {
+        if (entry.name === ORGANIZATION_WORKSPACE_MIGRATION_FILE)
+            continue;
         const sourcePath = path.join(sourceRoot, entry.name);
         const targetPath = path.join(targetRoot, entry.name);
         const targetStat = await lstatIfExists(targetPath);
-        if (!targetStat)
+        if (!targetStat) {
+            await assertPathMoveCanBeAtomic(sourcePath, targetPath);
             continue;
+        }
         if (entry.isDirectory() && targetStat.isDirectory()) {
             await assertCanMergeDirectoryContents(sourcePath, targetPath);
             continue;
@@ -814,7 +1415,9 @@ export async function pruneOrphanedOrganizationStorage(liveOrgIds) {
     const organizationDirNames = await listDirectoryNames(organizationRoot);
     const legacyProjectDirNames = await listDirectoryNames(legacyProjectsRoot);
     const legacyProjectsRootExists = await directoryExists(legacyProjectsRoot);
-    const removedOrganizationDirNames = organizationDirNames.filter((dirName) => dirName !== MIGRATION_BACKUP_DIR_NAME && !liveOrgIdSet.has(dirName));
+    const removedOrganizationDirNames = organizationDirNames.filter((dirName) => dirName !== MIGRATION_BACKUP_DIR_NAME
+        && !isOrganizationWorkspaceMapInternalDirectoryName(dirName)
+        && !liveOrgIdSet.has(dirName));
     const removedLegacyProjectDirNames = legacyProjectDirNames;
     await Promise.all([
         ...removedOrganizationDirNames.map((dirName) => fs.rm(path.resolve(organizationRoot, dirName), { recursive: true, force: true })),