@stowage/adapter-fs 0.1.0 → 0.2.0

package/README.md

@@ -31,30 +31,37 @@ The bundle measures 5.7 kB minified and gzipped, `@stowage/core` included.
 ## Limits
 
 - `keyBytesPreserved` is not declared: a key comes back Unicode-equivalent to what was written
-  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#49-capabilities)).
+  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#49-capabilities)).
 - `presignedUrls` is not declared: `FsStorage` has neither `presignGet` nor `presignPut`
-  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#49-capabilities)).
+  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#49-capabilities)).
 - `userMetadata` is not declared: `put` with a non-empty `userMetadata` is `Unsupported`, and reads
   return `{}`
-  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#49-capabilities)).
+  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#49-capabilities)).
+- `userMetadataTokenKeys` is not declared: without `userMetadata`, a key beyond identifiers is
+  `Unsupported` naming `userMetadata` like any other
+  ([spec 4.9](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#49-capabilities)).
 - A key segment longer than 255 bytes is `InvalidKey`, and so is a key whose whole path is longer
   than the file system holds. macOS bounds one path at 1024 bytes with the root counted in
-  ([spec 6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#6-stowageadapter-fs)).
+  ([spec 6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#6-stowageadapter-fs)).
+- A name the file system refuses to create is `InvalidKey` on `put` and on the destination of
+  `copy` and `move`. APFS refuses every noncharacter, so a key holding `U+FFFE` is written on
+  Linux and refused on macOS
+  ([spec 6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#6-stowageadapter-fs)).
 - APFS keeps a name in the Unicode form it was written in, and folds the forms when it looks a name
   up, so a key in NFD reaches the object its NFC form wrote. A case-insensitive file system collides
   keys that differ in case alone. Nothing repairs either
-  ([spec 6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#6-stowageadapter-fs)).
+  ([spec 6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#6-stowageadapter-fs)).
 - The content type is derived from the key's extension, and is `application/octet-stream` where the
   extension is unknown or absent. The `contentType` handed to `put` is not stored, so `stat` may
   report another one
-  ([spec 6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#6-stowageadapter-fs)).
+  ([spec 6](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#6-stowageadapter-fs)).
 - No `etag` is set
-  ([spec 4.4](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#44-object-descriptions)).
+  ([spec 4.4](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#44-object-descriptions)).
 
 ## Notes
 
 `put` takes no `Blob`. A caller holding one passes its stream
-([spec 4.2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#42-bodies)):
+([spec 4.2](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#42-bodies)):
 
 ```ts
 import { fsStorage } from "@stowage/adapter-fs";
@@ -66,7 +73,7 @@ await storage.put("reports/2026/q4.csv", blob.stream());
 ```
 
 stowage reports no progress
-([spec 11](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#11-non-goals)).
+([spec 12](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#12-non-goals)).
 A caller who wants it counts the bytes on their way into `put`:
 
 ```ts
@@ -95,10 +102,10 @@ await storage.put("videos/intro.mp4", response.body.pipeThrough(countBytes(conso
 
 ## Specification
 
-[`docs/spec.md` at `@stowage/adapter-fs@0.1.0`](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/docs/spec.md#6-stowageadapter-fs)
+[`docs/spec.md` at `@stowage/adapter-fs@0.2.0`](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/docs/spec.md#6-stowageadapter-fs)
 is the contract: a caller may rely on what it states and on nothing else this package happens to
-export. The [terms it uses](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.1.0/CONTEXT.md)
-and the [decisions behind it](https://github.com/stowage-js/stowage/tree/@stowage/adapter-fs@0.1.0/docs/adr)
+export. The [terms it uses](https://github.com/stowage-js/stowage/blob/@stowage/adapter-fs@0.2.0/CONTEXT.md)
+and the [decisions behind it](https://github.com/stowage-js/stowage/tree/@stowage/adapter-fs@0.2.0/docs/adr)
 are at the same tag.
 
 ## License

package/dist/index.js

@@ -1,8 +1,8 @@
 import { copyFile, lstat, mkdir, open, readdir, realpath, rename, rmdir, stat, unlink } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, sep } from "node:path";
-import { StorageError, invalidKeyReason, isStorageError } from "@stowage/core";
+import { StorageError, invalidKeyReason, isStorageError, lastByteOf, rangeBoundsRefusal, rangeStartRefusal } from "@stowage/core";
 //#region src/body.ts
-const utf8$1 = new TextEncoder();
+const utf8$2 = new TextEncoder();
 /**
 * Writes the body into the open file. A stream goes chunk by chunk, so that an upload of
 * any size costs one chunk of memory rather than the object.
@@ -15,7 +15,7 @@ async function writeBody(handle, body, signal) {
 		return;
 	}
 	signal?.throwIfAborted();
-	await writeAll(handle, typeof body === "string" ? utf8$1.encode(body) : body);
+	await writeAll(handle, typeof body === "string" ? utf8$2.encode(body) : body);
 }
 /** Spec 4.2 leaves a stream at its end or canceled once `put` settled, read or not. */
 async function cancelBody(body, reason) {
@@ -82,6 +82,41 @@ function contentTypeOf(key) {
 	return contentTypes.get(name.slice(dot + 1).toLowerCase()) ?? "application/octet-stream";
 }
 //#endregion
+//#region src/directory-lock.ts
+const directoryMutationLocks = /* @__PURE__ */ new Map();
+const doNothing = () => {};
+async function holdDirectoryMutations(realRoot) {
+	const lock = directoryMutationLocks.get(realRoot) ?? {
+		tail: Promise.resolve(),
+		leases: 0
+	};
+	const previous = lock.tail;
+	let releaseNext = doNothing;
+	lock.tail = new Promise((resolve) => {
+		releaseNext = resolve;
+	});
+	lock.leases += 1;
+	directoryMutationLocks.set(realRoot, lock);
+	await previous;
+	let held = true;
+	return () => {
+		if (!held) return;
+		held = false;
+		lock.leases -= 1;
+		releaseNext();
+		if (lock.leases === 0 && directoryMutationLocks.get(realRoot) === lock) directoryMutationLocks.delete(realRoot);
+	};
+}
+/** Runs the step with no directory below the root created or removed by anyone else. */
+async function withDirectoryMutations(realRoot, step) {
+	const release = await holdDirectoryMutations(realRoot);
+	try {
+		return await step();
+	} finally {
+		release();
+	}
+}
+//#endregion
 //#region src/cursor.ts
 const cursorTag = "stowage-fs-1:";
 const unitDigits = 4;
@@ -136,7 +171,7 @@ function isTemporaryName(name) {
 //#region src/key.ts
 /** What a file system takes as one name, which spec 6 has the adapter refuse beyond. */
 const segmentByteLimit = 255;
-const utf8 = new TextEncoder();
+const utf8$1 = new TextEncoder();
 function requireKey(root, key, rule, operation) {
 	const reason = invalidKeyReason(key, rule) ?? temporaryNameReason(key, rule) ?? longSegmentReason(key);
 	if (reason === void 0) return;
@@ -154,7 +189,7 @@ function temporaryNameReason(key, rule) {
 }
 function longSegmentReason(key) {
 	for (const segment of key.split("/")) {
-		const bytes = utf8.encode(segment).length;
+		const bytes = utf8$1.encode(segment).length;
 		if (bytes > segmentByteLimit) return `holds a segment of ${bytes} UTF-8 bytes, above the limit of ${segmentByteLimit}`;
 	}
 }
@@ -290,6 +325,10 @@ const errnoMappings = /* @__PURE__ */ new Map([
 	["EACCES", { code: "AccessDenied" }],
 	["EPERM", { code: "AccessDenied" }],
 	["ENAMETOOLONG", { code: "InvalidKey" }],
+	["EILSEQ", {
+		code: "NotFound",
+		onWrite: "InvalidKey"
+	}],
 	["EMFILE", {
 		code: "ProviderError",
 		retryable: true
@@ -329,10 +368,17 @@ function errnoOf(thrown) {
 	const code = Reflect.get(thrown, "code");
 	return typeof code === "string" ? code : void 0;
 }
-/** The key names nothing this storage holds, which is what an absent file amounts to. */
+/** The file system refuses to create the name, as APFS refuses a noncharacter (spec 6). */
+function refusesName(thrown) {
+	return errnoOf(thrown) === "EILSEQ";
+}
+/**
+* The key names nothing this storage holds, which is what an absent file amounts to, and
+* so is a name a file system refuses on a lookup: no file can be held under it.
+*/
 function isAbsence(thrown) {
 	const errno = errnoOf(thrown);
-	return errno === "ENOENT" || errno === "ENOTDIR";
+	return errno === "ENOENT" || errno === "ENOTDIR" || errno === "EILSEQ";
 }
 function messageOf(thrown) {
 	return thrown instanceof Error ? thrown.message : String(thrown);
@@ -415,15 +461,33 @@ async function resolveObject(context) {
 /**
 * The path a write lands under, with the directories above it in place. The nearest
 * existing directory is resolved before anything is created, so a link leaving the root
-* cannot cause this storage to create directories outside it.
+* cannot cause this storage to create directories outside it. The caller holds the
+* directory lock until the write's file is in place, since a prune may otherwise remove a
+* directory this found in place before anything lies in it.
 */
 async function prepareWrite(context) {
 	const path = pathOf(context.realRoot, context.key);
 	if (path === void 0) throw absent(context, 0);
-	const directory = await makeDirectory(dirname(path), context);
-	const target = join(directory, basename(path));
-	if (!await resolvesWithin(context, target)) throw absent(context, 1);
-	return target;
+	const { directory, created } = await makeDirectory(dirname(path), context);
+	const abandon = async () => await removeCreated(created);
+	try {
+		const target = join(directory, basename(path));
+		if (!await resolvesWithin(context, target)) throw absent(context, 1);
+		return {
+			path: target,
+			abandon
+		};
+	} catch (thrown) {
+		await abandon();
+		throw thrown;
+	}
+}
+async function removeCreated(created) {
+	for (const directory of created.toReversed()) try {
+		await rmdir(directory);
+	} catch {
+		return;
+	}
 }
 async function resolvesWithin(context, path) {
 	try {
@@ -451,32 +515,40 @@ async function makeDirectory(directory, context) {
 		existing = dirname(existing);
 	}
 	if (!within(context.realRoot, existing)) throw absent(context, 1);
-	for (const segment of missing) {
-		const path = join(existing, segment);
-		try {
-			await mkdir(path);
-		} catch (thrown) {
-			if (errnoOf(thrown) !== "EEXIST") throw fsErrorFrom(thrown, {
-				...context,
-				access: "write"
-			});
-		}
-		try {
-			existing = await realpath(path);
-		} catch (thrown) {
-			throw fsErrorFrom(thrown, {
-				...context,
-				access: "write"
-			});
+	const created = [];
+	try {
+		for (const segment of missing) {
+			const path = join(existing, segment);
+			try {
+				await mkdir(path);
+				created.push(path);
+			} catch (thrown) {
+				if (errnoOf(thrown) !== "EEXIST") throw fsErrorFrom(thrown, {
+					...context,
+					access: "write"
+				});
+			}
+			try {
+				existing = await realpath(path);
+			} catch (thrown) {
+				throw fsErrorFrom(thrown, {
+					...context,
+					access: "write"
+				});
+			}
+			if (!within(context.realRoot, existing)) throw absent(context, 1);
 		}
-		if (!within(context.realRoot, existing)) throw absent(context, 1);
+	} catch (thrown) {
+		await removeCreated(created);
+		throw thrown;
 	}
-	return existing;
+	return {
+		directory: existing,
+		created
+	};
 }
 //#endregion
 //#region src/object-file.ts
-const directoryMutationLocks = /* @__PURE__ */ new Map();
-const doNothing = () => {};
 /**
 * The file below the key, or `undefined` where the key names no object of this storage:
 * nothing at all, a directory, or a path that leaves the root (spec 6). What a listing
@@ -538,43 +610,21 @@ async function removeObjectFile(context, file) {
 * Moves the file to the path, which is the copy and the delete of spec 4.11 as one file
 * system performs them, and removes what the source left empty behind it.
 */
-async function renameObjectFile(context, file, path) {
+async function renameObjectFile(context, file, destination) {
+	try {
+		await rename(file.path, destination.path);
+	} catch (thrown) {
+		throw fsErrorFrom(thrown, {
+			...refusesName(thrown) ? destination.context : context,
+			access: "write"
+		});
+	}
 	try {
-		try {
-			await rename(file.path, path);
-		} catch (thrown) {
-			throw fsErrorFrom(thrown, {
-				...context,
-				access: "write"
-			});
-		}
 		await pruneEmptyDirectories(context.realRoot, dirname(file.path));
 	} finally {
 		file.release();
 	}
 }
-async function holdDirectoryMutations(realRoot) {
-	const lock = directoryMutationLocks.get(realRoot) ?? {
-		tail: Promise.resolve(),
-		leases: 0
-	};
-	const previous = lock.tail;
-	let releaseNext = doNothing;
-	lock.tail = new Promise((resolve) => {
-		releaseNext = resolve;
-	});
-	lock.leases += 1;
-	directoryMutationLocks.set(realRoot, lock);
-	await previous;
-	let held = true;
-	return () => {
-		if (!held) return;
-		held = false;
-		lock.leases -= 1;
-		releaseNext();
-		if (lock.leases === 0 && directoryMutationLocks.get(realRoot) === lock) directoryMutationLocks.delete(realRoot);
-	};
-}
 async function pruneEmptyDirectories(realRoot, directory) {
 	for (let current = directory; current !== realRoot && within(realRoot, current); current = dirname(current)) try {
 		await rmdir(current);
@@ -610,24 +660,24 @@ async function lookUp(context, read) {
 //#region src/range.ts
 /** Refuses bounds the spec does not allow, before the file is opened (spec 4.3). */
 function requireRange(root, range) {
-	if (range === void 0) return;
-	const { start, end } = range;
-	if (!isOffset(start) || end !== void 0 && (!isOffset(end) || end < start)) throw optionError(root, "range", "takes two whole numbers from zero up, `start` at most `end`", "get");
+	const refusal = rangeBoundsRefusal(range);
+	if (refusal !== void 0) throw fsError(root, {
+		...refusal,
+		operation: "get",
+		attempts: 0
+	});
 }
 /** The last byte the range names, both ends inclusive, clipped to what the file holds. */
-function lastByteOf(root, range, size, key) {
+function lastByteToRead(root, range, size, key) {
 	if (range === void 0) return size - 1;
-	if (range.start >= size) throw fsError(root, {
-		code: "InvalidRequest",
-		message: `The range starts beyond the ${size} bytes under the key ${JSON.stringify(key)}`,
+	const refusal = rangeStartRefusal(range, size, key);
+	if (refusal !== void 0) throw fsError(root, {
+		...refusal,
 		operation: "get",
 		key,
 		attempts: 1
 	});
-	return Math.min(range.end ?? size - 1, size - 1);
-}
-function isOffset(value) {
-	return Number.isInteger(value) && value >= 0;
+	return lastByteOf(range, size);
 }
 //#endregion
 //#region src/stored-object.ts
@@ -742,6 +792,8 @@ async function close(handle) {
 }
 //#endregion
 //#region src/walk.ts
+const utf8 = new TextEncoder();
+const strictUtf8 = new TextDecoder("utf-8", { fatal: true });
 /**
 * Every object below the prefix, sorted by key. A listing pages through one order, so
 * the snapshot it reads is sorted; the order itself is not promised (spec 4.6).
@@ -749,25 +801,34 @@ async function close(handle) {
 async function walkObjects(context, prefix) {
 	const entries = [];
 	const directory = prefix.slice(0, prefix.lastIndexOf("/") + 1);
-	await collect(context, entries, join(context.realRoot, ...directory.split("/")), directory);
+	await collect({
+		context,
+		entries,
+		prefix: utf8.encode(prefix)
+	}, join(context.realRoot, ...directory.split("/")), directory);
 	return entries.filter((entry) => entry.key.startsWith(prefix)).toSorted(byKey);
 }
-async function collect(context, entries, directory, keyPrefix) {
+async function collect(walk, directory, keyPrefix) {
+	const { context, entries } = walk;
 	let resolved;
 	let held;
 	try {
 		resolved = await realpath(directory);
 		if (!within(context.realRoot, resolved)) return;
-		held = await readdir(resolved, { withFileTypes: true });
+		held = await entriesOf(resolved);
 	} catch (thrown) {
 		if (isAbsence(thrown)) return;
 		throw failure(context, thrown);
 	}
 	for (const entry of held) {
+		if ("bytes" in entry) {
+			refuseUndecodableName(walk, keyPrefix, entry.bytes);
+			continue;
+		}
 		const path = join(resolved, entry.name);
 		const key = `${keyPrefix}${entry.name}`;
-		if (entry.isDirectory()) {
-			await collect(context, entries, path, `${key}/`);
+		if (entry.directory) {
+			await collect(walk, path, `${key}/`);
 			continue;
 		}
 		if (isTemporaryName(entry.name)) continue;
@@ -780,6 +841,71 @@ async function collect(context, entries, directory, keyPrefix) {
 	}
 }
 /**
+* The names of one level. The runtime decodes a name that is no UTF-8 with U+FFFD in
+* place of what it cannot read, so a level holding that character reads its names again
+* as bytes to tell such a name from one that holds U+FFFD as written.
+*/
+async function entriesOf(directory) {
+	const held = await readdir(directory, { withFileTypes: true });
+	if (!held.some((entry) => entry.name.includes("�"))) return held.map((entry) => ({
+		name: entry.name,
+		directory: entry.isDirectory()
+	}));
+	const names = await readdir(directory, { encoding: "buffer" });
+	const entries = [];
+	for (const bytes of names) {
+		const name = utf8NameOf(bytes);
+		if (name === void 0) {
+			entries.push({ bytes });
+			continue;
+		}
+		try {
+			entries.push({
+				name,
+				directory: (await lstat(join(directory, name))).isDirectory()
+			});
+		} catch (thrown) {
+			if (isAbsence(thrown)) continue;
+			throw thrown;
+		}
+	}
+	return entries;
+}
+function utf8NameOf(bytes) {
+	try {
+		return strictUtf8.decode(bytes);
+	} catch {
+		return;
+	}
+}
+/**
+* A name that is no UTF-8 has no key, and a key with U+FFFD in its place would reach
+* another object or none. Passing over it would let a move of the prefix lose the file
+* in silence, so a listing it falls below fails as one whose entry arrived without a key
+* (spec 4.6); a listing beside it goes on.
+*/
+function refuseUndecodableName(walk, keyPrefix, bytes) {
+	const path = new Uint8Array([...utf8.encode(keyPrefix), ...bytes]);
+	if (!startsWith(path, walk.prefix)) return;
+	throw fsError(walk.context.root, {
+		code: "ProviderError",
+		message: `The name ${escapedBytesOf(path)} is no UTF-8, so no key names it`,
+		operation: walk.context.operation,
+		attempts: 1,
+		retryable: false
+	});
+}
+function startsWith(bytes, start) {
+	return start.length <= bytes.length && start.every((byte, index) => bytes[index] === byte);
+}
+function escapedBytesOf(bytes) {
+	return `"${Array.from(bytes, (byte) => standsAsItIs(byte) ? String.fromCharCode(byte) : `\\x${byte.toString(16).toUpperCase().padStart(2, "0")}`).join("")}"`;
+}
+/** Printable ASCII but for the quote and the backslash, which would read as an escape. */
+function standsAsItIs(byte) {
+	return byte >= 32 && byte <= 126 && byte !== 34 && byte !== 92;
+}
+/**
 * What the entry holds, or `undefined` for everything that is no object: a link leaving
 * the root, a link to a directory, a socket, and a file another writer removed between
 * the listing of the level and the reading of it.
@@ -837,12 +963,30 @@ var FileSystemStorage = class {
 		this.#requireNoUserMetadata(options?.userMetadata, key);
 		options?.signal?.throwIfAborted();
 		const context = await this.#context(key, "put", "write");
-		const path = await prepareWrite(context);
-		return await this.#write(context, path, body, options?.signal);
+		const reserved = await withDirectoryMutations(context.realRoot, async () => await this.#reserve(context));
+		try {
+			return await this.#write(context, reserved, body, options?.signal);
+		} catch (thrown) {
+			await withDirectoryMutations(context.realRoot, reserved.prepared.abandon);
+			throw thrown;
+		}
+	}
+	/**
+	* The directories a write needs and the file its bytes land in, created while the caller
+	* holds the directory lock: once that file is there, no prune removes the directory it
+	* lies in, so the body streams in without the lock.
+	*/
+	async #reserve(context) {
+		const prepared = await prepareWrite(context);
+		const temporary = temporaryPathIn(dirname(prepared.path));
+		return {
+			prepared,
+			temporary,
+			handle: await abandoningOnFailure(prepared, async () => await this.#openTemporary(context, temporary))
+		};
 	}
-	async #write(context, path, body, signal) {
-		return await this.#land(context, path, async (temporary) => {
-			const handle = await this.#openTemporary(context, temporary);
+	async #write(context, { prepared, temporary, handle }, body, signal) {
+		return await this.#land(context, prepared.path, temporary, async () => {
 			try {
 				await writeBody(handle, body, signal);
 				signal?.throwIfAborted();
@@ -860,10 +1004,9 @@ var FileSystemStorage = class {
 	* reader sees the object as it was or as it now is and never half of a write. A write
 	* that broke takes its file with it, so that no listing names what never became one.
 	*/
-	async #land(context, path, fill, signal) {
-		const temporary = temporaryPathIn(dirname(path));
+	async #land(context, path, temporary, fill, signal) {
 		try {
-			const written = await fill(temporary);
+			const written = await fill();
 			signal?.throwIfAborted();
 			await rename(temporary, path);
 			return describe(context.key, written.size, written.mtime);
@@ -885,7 +1028,7 @@ var FileSystemStorage = class {
 		return createStoredObject(context, found.description, {
 			path: found.path,
 			start: options?.range?.start ?? 0,
-			end: lastByteOf(this.#root, options?.range, found.description.size, key)
+			end: lastByteToRead(this.#root, options?.range, found.description.size, key)
 		});
 	}
 	async stat(key, options) {
@@ -972,11 +1115,12 @@ var FileSystemStorage = class {
 		const ends = await this.#endpoints(from, to, "copy", options);
 		const source = await this.#requireFile(ends.from);
 		try {
-			const path = await prepareWrite(ends.to);
-			return await this.#land(ends.to, path, async (temporary) => {
+			const prepared = await prepareWrite(ends.to);
+			const temporary = temporaryPathIn(dirname(prepared.path));
+			return await abandoningOnFailure(prepared, async () => await this.#land(ends.to, prepared.path, temporary, async () => {
 				await this.#read(ends.from, source.path, temporary);
 				return await stat(temporary);
-			}, options?.signal);
+			}, options?.signal));
 		} finally {
 			releaseObjectFile(source);
 		}
@@ -996,9 +1140,14 @@ var FileSystemStorage = class {
 		const ends = await this.#endpoints(from, to, "move", options);
 		const source = await this.#requireFile(ends.from);
 		try {
-			const path = await prepareWrite(ends.to);
-			options?.signal?.throwIfAborted();
-			await renameObjectFile(ends.from, source, path);
+			const prepared = await prepareWrite(ends.to);
+			await abandoningOnFailure(prepared, async () => {
+				options?.signal?.throwIfAborted();
+				await renameObjectFile(ends.from, source, {
+					context: ends.to,
+					path: prepared.path
+				});
+			});
 			return describe(to, source.stats.size, source.stats.mtime);
 		} finally {
 			releaseObjectFile(source);
@@ -1107,5 +1256,13 @@ function describe(key, size, lastModified) {
 		userMetadata: noUserMetadata
 	};
 }
+async function abandoningOnFailure(prepared, write) {
+	try {
+		return await write();
+	} catch (thrown) {
+		await prepared.abandon();
+		throw thrown;
+	}
+}
 //#endregion
 export { fsStorage };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stowage/adapter-fs",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "stowage adapter rooting a storage in one directory of the local file system.",
   "keywords": [
     "adapter",
@@ -33,7 +33,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@stowage/core": "^0.1.0"
+    "@stowage/core": "^0.2.0"
   },
   "engines": {
     "node": ">=24"