grokbot-control 0.0.0-stage → 0.1.3

package/dist/sync/decode.d.ts

@@ -0,0 +1,83 @@
+/** Static 0.79.3 evidence: node-agent-coordinator Tt -> JSON.parse(h.decode(body))
+ * -> _b/Are discriminated UI-entry validator. See docs/protocol/transcript-body-0.79.3.md.
+ * A deliberately strict subset, NOT arbitrary UTF-8, protobuf guessing or decryption.
+ */
+export declare const DECODER = "grokbot-ui-entry-json/0.79.3-subset-v1";
+export declare const BODY_DECODE_MAX: number;
+export declare const SUPPORTED_KINDS: readonly ["message", "send-message", "tool-call", "notice", "user-attachment"];
+export type DecodedBody = {
+    format: typeof DECODER;
+    kind: (typeof SUPPORTED_KINDS)[number];
+    body_id: string;
+    role?: string;
+    role_source?: "body.role" | "ui-kind";
+    timestamp_ms?: string;
+    text?: string;
+    message_type?: "text" | "attachment";
+    tool_name?: string;
+    tool_status?: string;
+    attachment?: {
+        file_path: string;
+        file_name?: string;
+    };
+    suppressed?: boolean;
+};
+export type BodyDecode = {
+    decode_status: "decoded" | "opaque" | "absent" | "omitted";
+    decode_reason?: string;
+    encryption_status: "unknown" | "plaintext_json";
+    decoded?: DecodedBody;
+    body_source?: "observed_inline" | "hydrated_omitted" | "hydrated_blob";
+};
+export type Hydration = {
+    format_version: 1;
+    status: "fetched" | "error";
+    binding: string;
+    source: "omitted_list" | "blob";
+    context: {
+        archive_scope_sha256: string;
+        agent_id: string;
+        session_id: string;
+        generation: number;
+        seq: string;
+        updated_seq: string;
+        entry_id?: string;
+    };
+    observed_at_ms: string;
+    reason?: string;
+    body_base64?: string;
+    content_sha256?: string;
+    object_rel?: string;
+    remote_blob_ref?: string;
+    /** Attempts for this binding; deterministic failures set retry:"never". */
+    attempts?: number;
+    retry?: "never" | "retryable";
+    /** Meta/wire only — body bytes live in object_rel, not duplicated here. */
+    reread?: {
+        raw: unknown;
+        wire_base64?: string;
+        object_rel?: string;
+        content_sha256?: string;
+    };
+};
+export type ObjectReader = (rel: string) => Buffer | undefined;
+type StoredInput = {
+    archive_scope_sha256?: string;
+    body_base64?: string;
+    body_omitted: boolean;
+    entry_kind: string;
+    agent_id?: string;
+    session_id?: string;
+    generation?: number;
+    seq?: string;
+    updated_seq?: string;
+    entry_id?: string;
+    blob_hash?: string;
+    hydration?: Hydration;
+};
+export declare function hydrationBinding(e: StoredInput): string;
+export declare function verifiedHydratedBytes(e: StoredInput, readObject?: ObjectReader): Buffer | undefined;
+export declare function decodeBody(body: Uint8Array | undefined, omitted: boolean, outerKind: string): BodyDecode;
+/** Offline re-render also upgrades archives written before the decoder existed. */
+export declare function decodeStored(e: StoredInput, readObject?: ObjectReader): BodyDecode;
+export {};

package/dist/sync/decode.js

@@ -0,0 +1,229 @@
+import { createHash } from "node:crypto";
+/** Static 0.79.3 evidence: node-agent-coordinator Tt -> JSON.parse(h.decode(body))
+ * -> _b/Are discriminated UI-entry validator. See docs/protocol/transcript-body-0.79.3.md.
+ * A deliberately strict subset, NOT arbitrary UTF-8, protobuf guessing or decryption.
+ */
+export const DECODER = "grokbot-ui-entry-json/0.79.3-subset-v1";
+export const BODY_DECODE_MAX = 4 * 1024 * 1024;
+export const SUPPORTED_KINDS = [
+    "message",
+    "send-message",
+    "tool-call",
+    "notice",
+    "user-attachment",
+];
+export function hydrationBinding(e) {
+    return createHash("sha256")
+        .update(JSON.stringify([
+        e.archive_scope_sha256,
+        e.agent_id,
+        e.session_id,
+        e.generation,
+        e.seq,
+        e.updated_seq,
+        e.entry_id ?? null,
+        e.entry_kind,
+        e.blob_hash ?? null,
+        e.body_omitted,
+        e.body_base64 ?? null,
+    ]))
+        .digest("hex");
+}
+export function verifiedHydratedBytes(e, readObject) {
+    const h = e.hydration;
+    if (!h ||
+        h.format_version !== 1 ||
+        h.status !== "fetched" ||
+        h.binding !== hydrationBinding(e) ||
+        !/^[0-9a-f]{64}$/.test(h.content_sha256 ?? ""))
+        return;
+    const c = h.context;
+    if (!c ||
+        typeof e.archive_scope_sha256 !== "string" ||
+        !/^[0-9a-f]{64}$/.test(e.archive_scope_sha256) ||
+        c.archive_scope_sha256 !== e.archive_scope_sha256 ||
+        c.agent_id !== e.agent_id ||
+        c.session_id !== e.session_id ||
+        c.generation !== e.generation ||
+        c.seq !== e.seq ||
+        c.updated_seq !== e.updated_seq ||
+        c.entry_id !== e.entry_id)
+        return;
+    if (h.source !== "omitted_list" && h.source !== "blob")
+        return;
+    if (h.object_rel !== `bodies/objects/sha256-${h.content_sha256}`)
+        return;
+    // Canonical copy is the content-addressed object; body_base64 is legacy/optional.
+    if (readObject) {
+        try {
+            const b = readObject(h.object_rel);
+            if (b &&
+                b.byteLength <= BODY_DECODE_MAX &&
+                createHash("sha256").update(b).digest("hex") === h.content_sha256)
+                return b;
+        }
+        catch {
+            return;
+        }
+    }
+    if (typeof h.body_base64 !== "string")
+        return;
+    if (h.body_base64.length > Math.ceil(BODY_DECODE_MAX / 3) * 4)
+        return;
+    const b = Buffer.from(h.body_base64, "base64");
+    if (b.byteLength > BODY_DECODE_MAX ||
+        b.toString("base64") !== h.body_base64 ||
+        createHash("sha256").update(b).digest("hex") !== h.content_sha256)
+        return;
+    return b;
+}
+const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const optionalString = (v) => v === undefined || typeof v === "string";
+function opaque(reason) {
+    return {
+        decode_status: "opaque",
+        encryption_status: "unknown",
+        decode_reason: reason,
+    };
+}
+export function decodeBody(body, omitted, outerKind) {
+    if (omitted)
+        return { decode_status: "omitted", encryption_status: "unknown" };
+    if (body === undefined)
+        return { decode_status: "absent", encryption_status: "unknown" };
+    if (body.byteLength > BODY_DECODE_MAX)
+        return opaque("decoder_size_limit");
+    let v;
+    try {
+        v = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body));
+    }
+    catch {
+        return opaque("not_valid_utf8_json");
+    }
+    if (!object(v) ||
+        typeof v.id !== "string" ||
+        !v.id.length ||
+        v.id.length > 1024 ||
+        typeof v.kind !== "string")
+        return opaque("invalid_ui_entry_schema");
+    if (!SUPPORTED_KINDS.includes(v.kind))
+        return opaque("unsupported_ui_kind");
+    // UI uses the JSON discriminator; mismatching nonempty outer metadata is conservatively refused.
+    if (outerKind && outerKind !== v.kind)
+        return opaque("outer_inner_kind_mismatch");
+    const d = {
+        format: DECODER,
+        kind: v.kind,
+        body_id: v.id,
+    };
+    const t = v.timestampMs;
+    if (typeof t === "number" &&
+        Number.isSafeInteger(t) &&
+        t >= 0 &&
+        t <= 8640000000000000)
+        d.timestamp_ms = String(t);
+    switch (d.kind) {
+        case "message":
+            if (typeof v.content !== "string" || !optionalString(v.role))
+                return opaque("invalid_ui_entry_schema");
+            d.text = v.content;
+            if (typeof v.role === "string") {
+                d.role = v.role;
+                d.role_source = "body.role";
+            }
+            if (v.suppressed !== undefined && v.suppressed !== null)
+                d.suppressed = true;
+            break;
+        case "send-message":
+            if (!object(v.message))
+                return opaque("invalid_ui_entry_schema");
+            if (v.message.type === "attachment") {
+                if (typeof v.message.url !== "string" ||
+                    !optionalString(v.message.file_name))
+                    return opaque("invalid_ui_entry_schema");
+                d.message_type = "attachment";
+                d.attachment = {
+                    file_path: v.message.url,
+                    ...(typeof v.message.file_name === "string"
+                        ? { file_name: v.message.file_name }
+                        : {}),
+                };
+                d.role = "assistant";
+                d.role_source = "ui-kind";
+                break;
+            }
+            if (v.message.type !== "text")
+                return opaque("unsupported_send_message_type");
+            if (typeof v.message.content !== "string")
+                return opaque("invalid_ui_entry_schema");
+            d.message_type = "text";
+            d.text = v.message.content;
+            d.role = "assistant";
+            d.role_source = "ui-kind";
+            break;
+        case "tool-call":
+            if (typeof v.name !== "string" ||
+                !(v.summary === null || optionalString(v.summary)) ||
+                !(v.status === null || optionalString(v.status)))
+                return opaque("invalid_ui_entry_schema");
+            d.tool_name = v.name;
+            if (typeof v.summary === "string")
+                d.text = v.summary;
+            if (typeof v.status === "string")
+                d.tool_status = v.status;
+            break;
+        case "notice":
+            if (typeof v.text !== "string")
+                return opaque("invalid_ui_entry_schema");
+            d.text = v.text;
+            break;
+        case "user-attachment":
+            if (typeof v.file_path !== "string" || !optionalString(v.file_name))
+                return opaque("invalid_ui_entry_schema");
+            d.attachment = {
+                file_path: v.file_path,
+                ...(typeof v.file_name === "string" ? { file_name: v.file_name } : {}),
+            };
+            d.role = "user";
+            d.role_source = "ui-kind";
+            break;
+    }
+    return {
+        decode_status: "decoded",
+        encryption_status: "plaintext_json",
+        decoded: d,
+    };
+}
+/** Offline re-render also upgrades archives written before the decoder existed. */
+export function decodeStored(e, readObject) {
+    // Inline observation always wins, even if cached hydration was supplied.
+    if (e.body_base64 === undefined) {
+        const recovered = verifiedHydratedBytes(e, readObject);
+        if (recovered)
+            return {
+                ...decodeBody(recovered, false, e.entry_kind),
+                body_source: e.hydration.source === "blob" ? "hydrated_blob" : "hydrated_omitted",
+            };
+        if (e.hydration &&
+            (e.hydration.status === "fetched" || e.hydration.format_version !== 1))
+            return opaque("invalid_stored_hydration");
+    }
+    if (e.body_omitted && e.body_base64 === undefined)
+        return decodeBody(undefined, true, e.entry_kind);
+    if (e.body_base64 === undefined)
+        return decodeBody(undefined, false, e.entry_kind);
+    if (typeof e.body_base64 !== "string")
+        return opaque("invalid_stored_base64");
+    if (e.body_base64.length > Math.ceil(BODY_DECODE_MAX / 3) * 4)
+        return opaque("decoder_size_limit");
+    if (e.body_base64.length % 4 !== 0 ||
+        !/^[A-Za-z0-9+/]*={0,2}$/.test(e.body_base64))
+        return opaque("invalid_stored_base64");
+    const bytes = Buffer.from(e.body_base64, "base64");
+    if (bytes.toString("base64") !== e.body_base64)
+        return opaque("invalid_stored_base64");
+    return {
+        ...decodeBody(bytes, false, e.entry_kind),
+        body_source: "observed_inline",
+    };
+}

package/dist/sync/download-policy.d.ts

@@ -0,0 +1,3 @@
+import type { FetchFn } from "./attachments.js";
+export declare function publicAddress(ip: string): boolean;
+export declare const publicHttpsFetch: FetchFn;

package/dist/sync/download-policy.js

@@ -0,0 +1,103 @@
+/** Public HTTPS only. Resolve once, reject reserved addresses, pin request DNS result.
+ * No bearer/cookies, no redirects, standard TLS hostname/certificate validation.
+ * Injected fetch functions (tests) are trusted SDK code, not a CLI bypass.
+ */
+import https from "node:https";
+import dns from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { Readable } from "node:stream";
+const deny = new BlockList(), deny6 = new BlockList(), global6 = new BlockList();
+global6.addSubnet("2000::", 3, "ipv6");
+for (const [ip, bits] of [
+    ["0.0.0.0", 8],
+    ["10.0.0.0", 8],
+    ["100.64.0.0", 10],
+    ["127.0.0.0", 8],
+    ["169.254.0.0", 16],
+    ["172.16.0.0", 12],
+    ["192.0.0.0", 24],
+    ["192.0.2.0", 24],
+    ["192.168.0.0", 16],
+    ["192.88.99.0", 24],
+    ["198.18.0.0", 15],
+    ["198.51.100.0", 24],
+    ["203.0.113.0", 24],
+    ["224.0.0.0", 4],
+    ["240.0.0.0", 4],
+])
+    deny.addSubnet(ip, bits, "ipv4");
+for (const [ip, bits] of [
+    ["::", 96],
+    ["::ffff:0:0", 96],
+    ["fc00::", 7],
+    ["fe80::", 10],
+    ["ff00::", 8],
+    ["2001:db8::", 32],
+    ["2001::", 23],
+    ["2002::", 16],
+])
+    deny6.addSubnet(ip, bits, "ipv6");
+export function publicAddress(ip) {
+    const family = isIP(ip);
+    return (!!family &&
+        (family !== 6 || global6.check(ip, "ipv6")) &&
+        !(family === 4 ? deny : deny6).check(ip, family === 4 ? "ipv4" : "ipv6"));
+}
+export const publicHttpsFetch = async (value, init) => {
+    const u = new URL(value);
+    if (u.protocol !== "https:" ||
+        u.username ||
+        u.password ||
+        u.hash ||
+        (u.port && u.port !== "443"))
+        throw new Error("download policy");
+    const host = u.hostname.replace(/^\[|\]$/g, "");
+    if (init?.signal?.aborted)
+        throw new Error("aborted");
+    let listener;
+    let choices;
+    try {
+        choices = isIP(host)
+            ? [{ address: host, family: isIP(host) }]
+            : await Promise.race([
+                dns.lookup(host, { all: true }),
+                new Promise((_, reject) => {
+                    listener = () => reject(new Error("aborted"));
+                    init?.signal?.addEventListener("abort", listener, { once: true });
+                }),
+            ]);
+    }
+    finally {
+        if (listener)
+            init?.signal?.removeEventListener("abort", listener);
+    }
+    if (!choices.length || choices.some((c) => !publicAddress(c.address)))
+        throw new Error("download policy");
+    const chosen = choices[0];
+    return await new Promise((resolve, reject) => {
+        const headers = init?.headers;
+        const req = https.request(u, {
+            method: "GET",
+            signal: init?.signal ?? undefined,
+            headers,
+            lookup: ((_name, opts, cb) => opts?.all
+                ? cb(null, [chosen])
+                : cb(null, chosen.address, chosen.family)),
+        }, (res) => {
+            const status = res.statusCode ?? 500;
+            const h = new Headers();
+            for (const [k, v] of Object.entries(res.headers))
+                if (v !== undefined)
+                    h.set(k, Array.isArray(v) ? v.join(",") : v);
+            const empty = status === 204 || status === 304;
+            if (empty)
+                res.resume();
+            resolve(new Response(empty ? null : Readable.toWeb(res), {
+                status,
+                headers: h,
+            }));
+        });
+        req.on("error", reject);
+        req.end();
+    });
+};

package/dist/sync/fs.d.ts

@@ -0,0 +1,24 @@
+export declare function denied(message: string): never;
+export declare function hash(s: string): string;
+export declare function component(id: string): string;
+/** Default (unlisted) session has empty session_id on the wire (App omits it). */
+export declare function sessionComponent(id: string): string;
+export declare class Archive {
+    readonly root: string;
+    constructor(root: string, create?: boolean);
+    private directory;
+    file(rel: string, parents?: boolean): string;
+    read(rel: string, maxBytes?: number): string | undefined;
+    json(rel: string): any;
+    atomic(rel: string, text: string): void;
+    writeJson(rel: string, data: unknown): void;
+    syncDir(dir: string): void;
+    lock(): () => void;
+    stage(): {
+        write: (bytes: Uint8Array) => void;
+        commit: (target: string) => void;
+        discard: () => void;
+    };
+    /** Binary counterpart of atomic(); never follows symlinks. */
+    atomicBytes(rel: string, data: Uint8Array): void;
+}

package/dist/sync/fs.js

@@ -0,0 +1,252 @@
+/** Private, single-user archive. Never follows symlinks (including ancestors).
+ * Not a security boundary against another process running as the same OS user.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID, createHash } from "node:crypto";
+import { GbcError } from "../errors.js";
+export function denied(message) {
+    throw new GbcError("denied", message);
+}
+export function hash(s) {
+    return createHash("sha256").update(s).digest("hex");
+}
+export function component(id) {
+    if (!id || Buffer.byteLength(id) > 120 || /[\x00-\x1f]/.test(id))
+        throw new GbcError("invalid_argument", "ID must be nonempty, <=120 bytes, without control characters");
+    return "id-" + Buffer.from(id).toString("base64url");
+}
+/** Default (unlisted) session has empty session_id on the wire (App omits it). */
+export function sessionComponent(id) {
+    return id === "" ? "default" : component(id);
+}
+export class Archive {
+    root;
+    constructor(root, create = false) {
+        if (!root || !path.isAbsolute(root))
+            throw new GbcError("invalid_argument", "sync root must be an absolute path");
+        this.root = path.resolve(root);
+        if (this.root === path.parse(this.root).root)
+            denied("filesystem root is not an archive");
+        let cur = path.parse(this.root).root;
+        for (const part of this.root.slice(cur.length).split(path.sep)) {
+            cur = path.join(cur, part);
+            if (!fs.existsSync(cur)) {
+                // lstat also catches dangling symlinks, unlike existsSync.
+                try {
+                    fs.lstatSync(cur);
+                    denied("symlink in sync root");
+                }
+                catch (e) {
+                    if (e.code !== "ENOENT")
+                        throw e;
+                }
+                if (!create)
+                    throw new GbcError("not_found", "archive does not exist");
+                fs.mkdirSync(cur, { mode: 0o700 });
+                this.syncDir(path.dirname(cur));
+            }
+            const s = fs.lstatSync(cur);
+            if (!s.isDirectory() || s.isSymbolicLink())
+                denied("sync root ancestor must be a real directory");
+            if ((process.getuid && s.uid !== process.getuid() && s.uid !== 0) ||
+                (s.mode & 0o022 && !(s.mode & 0o1000)))
+                denied("sync root ancestors must be trusted and not group/world writable (sticky temporary directories excepted)");
+        }
+        this.directory(this.root);
+    }
+    directory(p) {
+        const s = fs.lstatSync(p);
+        if (!s.isDirectory() ||
+            s.isSymbolicLink() ||
+            (process.getuid && s.uid !== process.getuid()) ||
+            s.mode & 0o077)
+            denied("archive directories must be owned by current user and mode 0700");
+    }
+    file(rel, parents = false) {
+        if (!rel ||
+            path.isAbsolute(rel) ||
+            rel.split(/[\\/]/).some((p) => !p || p === "." || p === ".."))
+            denied("unsafe archive path");
+        this.directory(this.root);
+        const parts = rel.split("/");
+        let cur = this.root;
+        for (const part of parts.slice(0, -1)) {
+            cur = path.join(cur, part);
+            try {
+                this.directory(cur);
+            }
+            catch (e) {
+                if (e.code !== "ENOENT" || !parents)
+                    throw e;
+                fs.mkdirSync(cur, { mode: 0o700 });
+                this.syncDir(path.dirname(cur));
+                this.directory(cur);
+            }
+        }
+        const p = path.join(cur, parts.at(-1));
+        try {
+            const s = fs.lstatSync(p);
+            if (!s.isFile() ||
+                s.isSymbolicLink() ||
+                s.nlink !== 1 ||
+                (process.getuid && s.uid !== process.getuid()) ||
+                s.mode & 0o077)
+                denied("archive file must be private, regular and not linked");
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+        return p;
+    }
+    read(rel, maxBytes = 64 * 1024 * 1024) {
+        let fd;
+        try {
+            fd = fs.openSync(this.file(rel), fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+            const s = fs.fstatSync(fd);
+            if (!s.isFile() || s.size > maxBytes)
+                denied("archive file exceeds read bound or is not regular");
+            return fs.readFileSync(fd, "utf8");
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return undefined;
+            throw e;
+        }
+        finally {
+            if (fd !== undefined)
+                fs.closeSync(fd);
+        }
+    }
+    json(rel) {
+        const s = this.read(rel);
+        return s === undefined ? undefined : JSON.parse(s);
+    }
+    atomic(rel, text) {
+        const target = this.file(rel, true), tempRel = ".sync/staging/" + randomUUID() + ".tmp";
+        const tmp = this.file(tempRel, true);
+        const fd = fs.openSync(tmp, fs.constants.O_WRONLY |
+            fs.constants.O_CREAT |
+            fs.constants.O_EXCL |
+            fs.constants.O_NOFOLLOW, 0o600);
+        try {
+            fs.writeFileSync(fd, text);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        // Re-check destination and ancestors immediately before rename.
+        this.file(rel);
+        fs.renameSync(tmp, target);
+        this.syncDir(path.dirname(target));
+        this.syncDir(path.dirname(tmp));
+    }
+    writeJson(rel, data) {
+        this.atomic(rel, JSON.stringify(data, null, 2) + "\n");
+    }
+    syncDir(dir) {
+        const fd = fs.openSync(dir, fs.constants.O_RDONLY |
+            fs.constants.O_DIRECTORY |
+            fs.constants.O_NOFOLLOW);
+        try {
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    lock() {
+        const p = this.file(".sync/lock", true);
+        let fd;
+        try {
+            fd = fs.openSync(p, fs.constants.O_WRONLY |
+                fs.constants.O_CREAT |
+                fs.constants.O_EXCL |
+                fs.constants.O_NOFOLLOW, 0o600);
+        }
+        catch (e) {
+            if (e.code === "EEXIST")
+                throw new GbcError("conflict", "archive locked; never auto-remove a stale lock; verify no writer then remove manually");
+            throw e;
+        }
+        const token = randomUUID();
+        try {
+            fs.writeFileSync(fd, JSON.stringify({ token, pid: process.pid }));
+            fs.fsyncSync(fd);
+        }
+        catch (e) {
+            fs.closeSync(fd);
+            throw e;
+        }
+        fs.closeSync(fd);
+        this.syncDir(path.dirname(p));
+        return () => {
+            if (this.json(".sync/lock")?.token !== token)
+                denied("lock ownership changed; refusing release");
+            fs.unlinkSync(this.file(".sync/lock"));
+            this.syncDir(path.dirname(p));
+        };
+    }
+    stage() {
+        const rel = ".sync/staging/" + randomUUID() + ".tmp";
+        const tmp = this.file(rel, true);
+        const fd = fs.openSync(tmp, fs.constants.O_WRONLY |
+            fs.constants.O_CREAT |
+            fs.constants.O_EXCL |
+            fs.constants.O_NOFOLLOW, 0o600);
+        let open = true, exists = true;
+        const close = () => {
+            if (open) {
+                fs.closeSync(fd);
+                open = false;
+            }
+        };
+        return {
+            write: (bytes) => {
+                let off = 0;
+                while (off < bytes.length)
+                    off += fs.writeSync(fd, bytes, off, bytes.length - off);
+            },
+            commit: (target) => {
+                const dest = this.file(target, true);
+                fs.fsyncSync(fd);
+                close();
+                this.file(target);
+                fs.renameSync(tmp, dest);
+                exists = false;
+                this.syncDir(path.dirname(dest));
+                this.syncDir(path.dirname(tmp));
+            },
+            discard: () => {
+                close();
+                if (exists) {
+                    fs.unlinkSync(tmp);
+                    exists = false;
+                    this.syncDir(path.dirname(tmp));
+                }
+            },
+        };
+    }
+    /** Binary counterpart of atomic(); never follows symlinks. */
+    atomicBytes(rel, data) {
+        const target = this.file(rel, true), tempRel = ".sync/staging/" + randomUUID() + ".tmp";
+        const tmp = this.file(tempRel, true);
+        const fd = fs.openSync(tmp, fs.constants.O_WRONLY |
+            fs.constants.O_CREAT |
+            fs.constants.O_EXCL |
+            fs.constants.O_NOFOLLOW, 0o600);
+        try {
+            fs.writeFileSync(fd, data);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        this.file(rel);
+        fs.renameSync(tmp, target);
+        this.syncDir(path.dirname(target));
+        this.syncDir(path.dirname(tmp));
+    }
+}