@stonyx/utils 0.2.3-alpha.28 → 0.2.3-alpha.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/file.js +9 -6
  2. package/package.json +1 -1
package/dist/file.js CHANGED
@@ -3,7 +3,7 @@ import { objToJson } from './object.js';
3
3
  import fs from 'fs';
4
4
  import { promises as fsp } from 'fs';
5
5
  import path from 'path';
6
- import { randomUUID } from 'crypto';
6
+ import { randomBytes } from 'crypto';
7
7
  function isNodeError(error) {
8
8
  return error instanceof Error && 'code' in error;
9
9
  }
@@ -60,11 +60,14 @@ export async function updateFile(filePath, data, options = {}) {
60
60
  const targetMode = mode & 0o7777;
61
61
  // pid + random token, never a timestamp: the swap name is a uniqueness
62
62
  // token, and whole seconds cannot discriminate between concurrent callers.
63
- // Truncated to 8 hex chars deliberately — a full 36-char UUID pushed the
64
- // name overhead to 48 characters and made ~210-character basenames fail
65
- // ENAMETOOLONG on a 255-byte NAME_MAX. `wx` below makes any residual
66
- // collision loud, so the shortened token costs no safety.
67
- const swapFile = `${filePath}.temp-${process.pid}-${randomUUID().slice(0, 8)}`;
63
+ // The token is deliberately short — a full 36-char UUID pushed the name
64
+ // overhead to 48 characters and made ~210-character basenames fail
65
+ // ENAMETOOLONG on a 255-byte NAME_MAX. 6 CSPRNG bytes as base64url is 8
66
+ // characters carrying 48 bits, where the first 8 hex characters of a UUID
67
+ // would be the same width but only 32 bits; at 32 bits a 1000-sample
68
+ // distinctness check collides about once in 8,600 runs. `wx` below makes
69
+ // any residual collision loud rather than corrupting.
70
+ const swapFile = `${filePath}.temp-${process.pid}-${randomBytes(6).toString('base64url')}`;
68
71
  try {
69
72
  // `wx` turns any residual name collision into a loud EEXIST rather than a
70
73
  // silent overwrite of another caller's swap bytes. `mode` here is masked
package/package.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "keywords": [
4
4
  "stonyx-module"
5
5
  ],
6
- "version": "0.2.3-alpha.28",
6
+ "version": "0.2.3-alpha.29",
7
7
  "description": "Utils module for Stonyx Framework",
8
8
  "repository": {
9
9
  "type": "git",