adapt-server 0.2.4__tar.gz → 0.2.6__tar.gz

{adapt_server-0.2.4 → adapt_server-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adapt-server
-Version: 0.2.4
+Version: 0.2.6
 Summary: Adaptive file-backed FastAPI server that turns datasets into CRUD APIs and UIs.
 Author-email: notesofcliff <notesofcliff@gmail.com>
 License-Expression: MIT
@@ -207,6 +207,8 @@ anonymous path, since MCP has no concept of a browser session. Set
 `mcp_enabled: false` in `.adapt/conf.json` (or `ADAPT_MCP_ENABLED=false`) to
 remove `/mcp` entirely. Full walkthrough, troubleshooting, and the tool
 reference table: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md).
+For dataset reads, `sort` is the column name and `order` must be `asc` or
+`desc`.
 
 ## Dataset Mutation Envelope
 

{adapt_server-0.2.4 → adapt_server-0.2.6}/README.md

@@ -161,6 +161,8 @@ anonymous path, since MCP has no concept of a browser session. Set
 `mcp_enabled: false` in `.adapt/conf.json` (or `ADAPT_MCP_ENABLED=false`) to
 remove `/mcp` entirely. Full walkthrough, troubleshooting, and the tool
 reference table: [docs/manual/mcp_guide.md](docs/manual/mcp_guide.md).
+For dataset reads, `sort` is the column name and `order` must be `asc` or
+`desc`.
 
 ## Dataset Mutation Envelope
 

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/__init__.py

@@ -1,3 +1,3 @@
 """Adapt package namespace."""
 
-__version__ = "0.2.4"
+__version__ = "0.2.6"

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/cache.py

@@ -8,12 +8,22 @@ import threading
 import logging
 from datetime import datetime, timedelta, timezone
 import pickle
+from pathlib import Path
 
 logger = logging.getLogger(__name__)
 
 CACHE_TABLE = "cache"
-_lock = threading.Lock()
+_lock = threading.RLock()
 _db_path: str | None = None
+_CREATE_CACHE_TABLE_SQL = f"""
+    CREATE TABLE IF NOT EXISTS {CACHE_TABLE} (
+        key TEXT PRIMARY KEY,
+        value BLOB,
+        expires_at DATETIME,
+        resource TEXT,
+        user TEXT
+    )
+"""
 
 
 def _default_db_path() -> str:
@@ -35,24 +45,22 @@ def configure(db_path: str | None) -> None:
 def _get_conn():
     """Get a SQLite connection to the cache database."""
     path = _db_path or _default_db_path()
+    Path(path).parent.mkdir(parents=True, exist_ok=True)
     conn = sqlite3.connect(path, check_same_thread=False)
     conn.row_factory = sqlite3.Row
+    _ensure_cache_table(conn)
     return conn
 
+
+def _ensure_cache_table(conn: sqlite3.Connection) -> None:
+    """Ensure the cache table exists for the active database connection."""
+    conn.execute(_CREATE_CACHE_TABLE_SQL)
+    conn.commit()
+
 def init_cache_table():
     """Initialize the cache table in the SQLite database."""
     with _lock:
         conn = _get_conn()
-        conn.execute(f"""
-            CREATE TABLE IF NOT EXISTS {CACHE_TABLE} (
-                key TEXT PRIMARY KEY,
-                value BLOB,
-                expires_at DATETIME,
-                resource TEXT,
-                user TEXT
-            )
-        """)
-        conn.commit()
         conn.close()
     logger.debug("Cache table initialized")
 

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/cli.py

@@ -36,6 +36,12 @@ def main() -> None:
     user_parser.add_argument("root", nargs="?", default=".", help="Document root containing the SQLite store")
     user_parser.add_argument("--username", required=True, help="Username for the superuser")
     user_parser.add_argument("--password", help="Password (will prompt if missing)")
+    user_parser.add_argument("--password-confirm", help="Password confirmation for non-interactive use")
+    user_parser.add_argument(
+        "--allow-weak-password",
+        action="store_true",
+        help="Allow a weak password without the safety confirmation prompt",
+    )
 
     list_parser = subparsers.add_parser("list-endpoints", help="List the auto-generated REST/UI endpoints")
     list_parser.add_argument("root", nargs="?", default=".", help="Document root to inspect")
@@ -65,6 +71,12 @@ def main() -> None:
     admin_create_user_parser.add_argument("root", nargs="?", default=".", help="Document root")
     admin_create_user_parser.add_argument("--username", required=True, help="Username")
     admin_create_user_parser.add_argument("--password", help="Password (will prompt if missing)")
+    admin_create_user_parser.add_argument("--password-confirm", help="Password confirmation for non-interactive use")
+    admin_create_user_parser.add_argument(
+        "--allow-weak-password",
+        action="store_true",
+        help="Allow a weak password without the safety confirmation prompt",
+    )
     admin_create_user_parser.add_argument("--superuser", action="store_true", help="Create as superuser")
 
     admin_delete_user_parser = admin_subparsers.add_parser("delete-user", help="Delete user")
@@ -116,7 +128,13 @@ def main() -> None:
         check.run_check(Path(args.root).resolve())
     elif args.command == "addsuperuser":
         logger.info("Running addsuperuser command for username=%s", args.username)
-        addsuperuser.run_add_superuser(Path(args.root).resolve(), args.username, args.password)
+        addsuperuser.run_add_superuser(
+            Path(args.root).resolve(),
+            args.username,
+            args.password,
+            password_confirm=args.password_confirm,
+            allow_weak_password=args.allow_weak_password,
+        )
     elif args.command == "list-endpoints":
         logger.info("Running list-endpoints command with root=%s", args.root)
         list_endpoints.run_list_endpoints(Path(args.root).resolve())

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/commands/addsuperuser.py

@@ -1,4 +1,3 @@
-import getpass
 from pathlib import Path
 import logging
 
@@ -7,17 +6,26 @@ from sqlmodel import Session, select
 from ..config import AdaptConfig
 from ..storage import User, init_database
 from ..auth.password import hash_password
+from .passwords import resolve_password
 
 logger = logging.getLogger(__name__)
 
 
-def run_add_superuser(root: Path, username: str, password: str | None) -> None:
+def run_add_superuser(
+    root: Path,
+    username: str,
+    password: str | None,
+    password_confirm: str | None = None,
+    allow_weak_password: bool = False,
+) -> None:
     """Create a new superuser account.
 
     Args:
         root: The root directory path for the Adapt configuration.
         username: The username for the new superuser.
         password: The password for the new superuser. If None, prompts for input.
+        password_confirm: Confirmation for non-interactive password entry.
+        allow_weak_password: Allow weak passwords without an interactive override prompt.
 
     Returns:
         None
@@ -27,8 +35,15 @@ def run_add_superuser(root: Path, username: str, password: str | None) -> None:
     """
     config = AdaptConfig(root=root)
     engine = init_database(config.db_path)
+    password = resolve_password(
+        username=username,
+        password=password,
+        password_confirm=password_confirm,
+        allow_weak_password=allow_weak_password,
+    )
     if password is None:
-        password = getpass.getpass("Password: ")
+        logger.warning("Aborted superuser creation for %s due to password validation", username)
+        return
 
     hashed = hash_password(password)
     logger.debug("Hashed password for user %s", username)
@@ -43,4 +58,4 @@ def run_add_superuser(root: Path, username: str, password: str | None) -> None:
         session.add(user)
         session.commit()
         logger.info("Created superuser '%s'", username)
-        print(f"Created superuser '{username}'")
+        print(f"Created superuser '{username}'")

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/commands/admin/__init__.py

@@ -51,7 +51,9 @@ def run_admin(args):
             root=Path(args.root).resolve(),
             username=args.username,
             password=args.password,
+            password_confirm=args.password_confirm,
             is_superuser=args.superuser,
+            allow_weak_password=args.allow_weak_password,
         )
     elif args.admin_command == "delete-user":
         logger.debug("Running admin command: delete-user for username=%s", args.username)
@@ -70,4 +72,4 @@ def run_admin(args):
         run_remove_from_group(Path(args.root).resolve(), args.username, args.group)
     else:
         logger.error("Unknown admin command: %s", args.admin_command)
-        raise ValueError(f"Unknown admin command: {args.admin_command}")
+        raise ValueError(f"Unknown admin command: {args.admin_command}")

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/commands/admin/create_user.py

@@ -1,4 +1,3 @@
-import getpass
 from pathlib import Path
 import logging
 
@@ -7,17 +6,32 @@ from sqlmodel import Session, select
 from ...auth.password import hash_password
 from ...config import AdaptConfig
 from ...storage import User, init_database
+from ..passwords import resolve_password
 
 logger = logging.getLogger(__name__)
 
 
-def run_create_user(root: Path, username: str, password: str | None, is_superuser: bool = False) -> None:
+def run_create_user(
+    root: Path,
+    username: str,
+    password: str | None,
+    password_confirm: str | None = None,
+    is_superuser: bool = False,
+    allow_weak_password: bool = False,
+) -> None:
     """Create a user account."""
     config = AdaptConfig(root=root)
     engine = init_database(config.db_path)
 
+    password = resolve_password(
+        username=username,
+        password=password,
+        password_confirm=password_confirm,
+        allow_weak_password=allow_weak_password,
+    )
     if password is None:
-        password = getpass.getpass("Password: ")
+        logger.warning("Aborted user creation for %s due to password validation", username)
+        return
 
     with Session(engine) as db:
         existing = db.exec(select(User).where(User.username == username)).first()

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/commands/check.py

@@ -38,10 +38,10 @@ def run_check(root: Path) -> None:
     print(f"SQLite store: {config.db_path} (engine {engine})")
     print(f"Discovered {count} dataset(s)")
 
-    # Markdown and HTML resources mount at /<namespace>, so they can collide
-    # with built-in routes; datasets live under /api and /ui and cannot.
+    # Markdown, HTML, and file resources mount at /<namespace>, so they can
+    # collide with built-in routes; datasets live under /api and /ui and cannot.
     for resource in resources:
-        if resource.resource_type not in ("markdown", "html"):
+        if resource.resource_type not in ("markdown", "html", "file"):
             continue
         namespace = resource.relative_path.with_suffix("").as_posix()
         if namespace in RESERVED_NAMESPACES:

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/commands/list_endpoints.py

@@ -34,7 +34,7 @@ def run_list_endpoints(root: Path) -> None:
     logger.debug("Listing endpoints for %d resources", len(resources))
     for resource in resources:
         namespace = resource.relative_path.with_suffix("").as_posix()
-        if resource.resource_type not in ("html", "markdown"):
+        if resource.resource_type not in ("html", "markdown", "file"):
             print(f"/api/{namespace}")
             print(f"/ui/{namespace}")
             print(f"/schema/{namespace}")

adapt_server-0.2.6/adapt/commands/passwords.py

@@ -0,0 +1,116 @@
+from __future__ import annotations
+
+import getpass
+import logging
+import re
+import sys
+
+logger = logging.getLogger(__name__)
+
+_COMMON_PASSWORDS = {
+    "123456",
+    "12345678",
+    "123456789",
+    "admin",
+    "admin123",
+    "changeme",
+    "letmein",
+    "password",
+    "password1",
+    "password123",
+    "qwerty",
+    "welcome",
+}
+_COMMON_SEQUENCES = ("12345", "54321", "abcdef", "fedcba", "qwerty", "asdf", "zxcv")
+
+
+def is_weak_password(password: str, username: str | None = None) -> bool:
+    """Return True when the password is easily guessed by common heuristics."""
+    normalized = password.casefold()
+    compact = re.sub(r"[^a-z0-9]", "", normalized)
+
+    if len(password) < 10:
+        return True
+    if normalized in _COMMON_PASSWORDS or compact in _COMMON_PASSWORDS:
+        return True
+    if username and username.casefold() in normalized:
+        return True
+    if len(set(normalized)) <= 2:
+        return True
+    if any(sequence in compact for sequence in _COMMON_SEQUENCES):
+        return True
+
+    classes = sum(
+        (
+            any(ch.islower() for ch in password),
+            any(ch.isupper() for ch in password),
+            any(ch.isdigit() for ch in password),
+            any(not ch.isalnum() for ch in password),
+        )
+    )
+    if len(password) >= 12 and classes >= 3:
+        return False
+    return not (len(password) >= 10 and classes == 4)
+
+
+def resolve_password(
+    *,
+    username: str,
+    password: str | None,
+    password_confirm: str | None = None,
+    allow_weak_password: bool = False,
+) -> str | None:
+    """Collect, confirm, and validate a password for CLI user creation."""
+    if password is None:
+        return _prompt_for_password(username=username)
+
+    if password_confirm is None:
+        if not sys.stdin.isatty():
+            print("Password confirmation required. Re-run with --password-confirm for non-interactive use.")
+            return None
+        password_confirm = getpass.getpass("Confirm password: ")
+
+    if password != password_confirm:
+        logger.warning("Password confirmation mismatch for user %s", username)
+        print("Passwords do not match.")
+        return None
+
+    if is_weak_password(password, username=username):
+        if allow_weak_password:
+            return password
+        if not sys.stdin.isatty():
+            print(
+                "This password appears weak and may be easily guessed. "
+                "Choose a stronger password or re-run with --allow-weak-password."
+            )
+            return None
+        if not _confirm_weak_password():
+            print("Password not accepted.")
+            return None
+
+    return password
+
+
+def _prompt_for_password(*, username: str) -> str:
+    while True:
+        password = getpass.getpass("Password: ")
+        password_confirm = getpass.getpass("Confirm password: ")
+        if password != password_confirm:
+            logger.warning("Password confirmation mismatch for user %s", username)
+            print("Passwords do not match. Please try again.")
+            continue
+        if is_weak_password(password, username=username) and not _confirm_weak_password():
+            print("Please choose a stronger password.")
+            continue
+        return password
+
+
+def _confirm_weak_password() -> bool:
+    while True:
+        answer = input("This password appears weak and may be easily guessed. Use it anyway? [y/N]: ")
+        normalized = answer.strip().casefold()
+        if normalized in {"y", "yes"}:
+            return True
+        if normalized in {"", "n", "no"}:
+            return False
+        print("Please answer 'y' or 'n'.")

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/config.py

@@ -45,7 +45,16 @@ class AdaptConfig:
         ".parquet": "adapt.plugins.parquet_plugin.ParquetPlugin",
         ".py": "adapt.plugins.python_plugin.PythonHandlerPlugin",
         ".html": "adapt.plugins.html_plugin.HtmlPlugin",
-        ".txt": "adapt.plugins.html_plugin.HtmlPlugin",
+        ".txt": "adapt.plugins.file_plugin.FilePlugin",
+        ".pdf": "adapt.plugins.file_plugin.FilePlugin",
+        ".json": "adapt.plugins.file_plugin.FilePlugin",
+        ".xml": "adapt.plugins.file_plugin.FilePlugin",
+        ".svg": "adapt.plugins.file_plugin.FilePlugin",
+        ".png": "adapt.plugins.file_plugin.FilePlugin",
+        ".jpg": "adapt.plugins.file_plugin.FilePlugin",
+        ".jpeg": "adapt.plugins.file_plugin.FilePlugin",
+        ".gif": "adapt.plugins.file_plugin.FilePlugin",
+        ".webp": "adapt.plugins.file_plugin.FilePlugin",
         ".md": "adapt.plugins.markdown_plugin.MarkdownPlugin",
         ".mp4": "adapt.plugins.media_plugin.MediaPlugin",
         ".mp3": "adapt.plugins.media_plugin.MediaPlugin",

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/locks.py

@@ -47,18 +47,22 @@ class LockManager:
                 return lock
             except IntegrityError:
                 db.rollback()
-                # Lock exists, check if expired
+                # Another writer won the unique-constraint race. Only retry if we can
+                # positively reclaim an expired row; otherwise report a clean conflict.
                 existing = db.exec(select(LockRecord).where(LockRecord.resource == resource)).first()
                 if existing and (existing.expires_at is None or existing.expires_at.replace(tzinfo=timezone.utc) > now):
                     logger.warning(f"Lock already exists for {resource} by {existing.owner}")
                     raise RuntimeError(f"Resource '{resource}' is already locked by {existing.owner}")
-                else:
-                    # Expired lock, delete and retry
+
+                if existing is not None:
+                    logger.debug(f"Expired lock found for {resource}, removing stale row")
                     db.delete(existing)
                     db.commit()
-                    logger.debug(f"Expired lock removed for {resource}, retrying")
                     return self.acquire_lock(resource, owner, reason, ttl_seconds)
 
+                logger.warning(f"Lock acquisition race detected for {resource} with no remaining row")
+                raise RuntimeError(f"Resource '{resource}' is already locked")
+
     def release_lock(self, lock_id: int) -> bool:
         """Release the lock with *lock_id*; returns True if a lock was deleted."""
         logger.info(f"Releasing lock {lock_id}")

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/mcp.py

@@ -8,11 +8,12 @@ API surface, no duplicated authorization logic.
 from __future__ import annotations
 
 import logging
-from typing import Any, Literal
+from typing import Annotated, Any, Literal
 
 from fastapi import HTTPException, Request
 from mcp.server.fastmcp import Context, FastMCP
 from mcp.server.fastmcp.exceptions import ToolError
+from pydantic import Field
 from sqlmodel import Session
 
 from .auth.dependencies import check_permission, get_current_user
@@ -26,6 +27,19 @@ from .storage import User
 
 logger = logging.getLogger(__name__)
 
+SortParam = Annotated[
+    str | None,
+    Field(description="Dataset column name to sort by, for example `category` or `price`."),
+]
+OrderParam = Annotated[
+    Literal["asc", "desc"],
+    Field(description="Sort direction for dataset reads. Use `sort` for the column name and `order` for `asc` or `desc`."),
+]
+FilterParam = Annotated[
+    dict[str, Any] | None,
+    Field(description="Optional dataset filter object, using the same shape as the REST API."),
+]
+
 
 async def _authenticated_user(ctx: Context) -> User:
     """Resolve the calling user from the request's `X-API-Key` header.
@@ -102,11 +116,15 @@ def build_mcp_server(config: AdaptConfig) -> FastMCP:
         ctx: Context,
         limit: int | None = None,
         offset: int = 0,
-        sort: str | None = None,
-        order: str = "asc",
-        filter: dict | None = None,
+        sort: SortParam = None,
+        order: OrderParam = "asc",
+        filter: FilterParam = None,
     ) -> Any:
-        """Read a resource's content, permission-checked like the REST API."""
+        """Read a resource's content, permission-checked like the REST API.
+
+        For dataset resources, `sort` is the column name and `order` must be
+        `asc` or `desc`.
+        """
         request = ctx.request_context.request
         user = await _authenticated_user(ctx)
         entry = _authorized_entry(request, user, resource, "read")

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/plugins/__init__.py

@@ -5,6 +5,7 @@ logger = logging.getLogger(__name__)
 from .base import Plugin, PluginContext, ResourceDescriptor, discover_plugins
 from .csv_plugin import CsvPlugin
 from .excel_plugin import ExcelPlugin
+from .file_plugin import FilePlugin
 from .media_plugin import MediaPlugin
 from .python_plugin import PythonHandlerPlugin
 
@@ -17,6 +18,7 @@ __all__ = [
     "discover_plugins",
     "CsvPlugin",
     "ExcelPlugin",
+    "FilePlugin",
     "MediaPlugin",
     "PythonHandlerPlugin",
-]
+]

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/plugins/base.py

@@ -3,9 +3,13 @@ from __future__ import annotations
 
 from abc import ABC, abstractmethod
 from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any, Iterable, Sequence, TYPE_CHECKING
+import errno
 import logging
+import os
+from pathlib import Path
+import shutil
+import tempfile
+from typing import Any, Callable, Iterable, Sequence, TYPE_CHECKING
 
 from fastapi import Request
 from fastapi.routing import APIRouter
@@ -159,4 +163,28 @@ def ensure_file(path: Path, content: str) -> None:
         return
     path.parent.mkdir(parents=True, exist_ok=True)
     path.write_text(content, encoding="utf-8")
-    logger.debug("Created file %s", path)
+    logger.debug("Created file %s", path)
+
+
+def atomic_write(target: Path, suffix: str, write_fn: Callable[[Path], None]) -> None:
+    """Write via a temp file on the target filesystem with EXDEV fallback."""
+    target.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp_name = tempfile.mkstemp(
+        dir=target.parent,
+        prefix=f".{target.stem}.",
+        suffix=suffix,
+    )
+    os.close(fd)
+    tmp_path = Path(tmp_name)
+
+    try:
+        write_fn(tmp_path)
+        try:
+            os.replace(tmp_path, target)
+        except OSError as exc:
+            if exc.errno != errno.EXDEV:
+                raise
+            shutil.copyfile(tmp_path, target)
+            tmp_path.unlink()
+    finally:
+        tmp_path.unlink(missing_ok=True)

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/plugins/csv_plugin.py

@@ -6,7 +6,7 @@ from pathlib import Path
 from typing import Any
 import logging
 
-from .base import ResourceDescriptor
+from .base import ResourceDescriptor, atomic_write
 from .dataset_plugin import DatasetPlugin
 
 logger = logging.getLogger(__name__)
@@ -51,17 +51,14 @@ class CsvPlugin(DatasetPlugin):
 
     def _write_rows(self, resource: ResourceDescriptor, rows: list[dict[str, Any]], header: list[str]) -> None:
         """Write rows back to CSV file atomically."""
-        # Write back atomically
-        import tempfile
-        import os
-        with tempfile.NamedTemporaryFile(mode='w', suffix='.csv', delete=False, newline='', encoding='utf-8') as tmp_fh:
-            writer = csv.writer(tmp_fh)
-            writer.writerow(header)
-            for row in rows:
-                writer.writerow([row.get(col, "") for col in header])
-            tmp_path = tmp_fh.name
+        def write_tmp(tmp_path: Path) -> None:
+            with tmp_path.open(mode="w", newline="", encoding="utf-8") as tmp_fh:
+                writer = csv.writer(tmp_fh)
+                writer.writerow(header)
+                for row in rows:
+                    writer.writerow([row.get(col, "") for col in header])
 
-        os.replace(tmp_path, resource.path)
+        atomic_write(resource.path, ".csv", write_tmp)
         # Invalidate cache after mutation
         invalidate_cache(str(resource.path))
-        logger.debug("Wrote %d rows to %s", len(rows), resource.path)
+        logger.debug("Wrote %d rows to %s", len(rows), resource.path)

{adapt_server-0.2.4 → adapt_server-0.2.6}/adapt/plugins/excel_plugin.py

@@ -7,7 +7,7 @@ from typing import Any, Sequence
 
 from openpyxl import load_workbook
 
-from .base import ResourceDescriptor
+from .base import ResourceDescriptor, atomic_write
 from .dataset_plugin import DatasetPlugin
 
 
@@ -103,9 +103,6 @@ class ExcelPlugin(DatasetPlugin):
         """
         logger.info(f"Writing rows to Excel worksheet: {resource.metadata.get('sub_namespace', '')}")
         sub_namespace = resource.metadata["sub_namespace"]
-        # Write back atomically
-        import tempfile
-        import os
         workbook = load_workbook(resource.path)
         try:
             sheet = workbook[sub_namespace]
@@ -117,13 +114,14 @@ class ExcelPlugin(DatasetPlugin):
             for row_idx, row_data in enumerate(rows, start=2):
                 for col_idx, col_name in enumerate(header):
                     sheet.cell(row=row_idx, column=col_idx+1).value = row_data.get(col_name, "")
-            with tempfile.NamedTemporaryFile(delete=False, suffix='.xlsx') as tmp_fh:
-                workbook.save(tmp_fh.name)
-                tmp_path = tmp_fh.name
+
+            def write_tmp(tmp_path: Path) -> None:
+                workbook.save(tmp_path)
+
+            atomic_write(resource.path, ".xlsx", write_tmp)
         finally:
             workbook.close()
 
-        os.replace(tmp_path, resource.path)
         # Invalidate cache after mutation
         invalidate_cache(str(resource.path))
         logger.debug(f"Successfully wrote {len(rows)} rows to Excel file: {resource.path}")