Secure filesystem adapter

NativeOutputRoot.publishDirectory(name, entries, maxBytes) prepares one to 128 uniquely named files in a private root-relative staging directory, flushes their data and publishes the directory without replacing any existing entry. Entry names contain no path components and must be unique ignoring ASCII case. All buffers are copied and the combined byte budget is enforced before asynchronous work. Linux uses renameat2 with RENAME_NOREPLACE, macOS uses renameatx_np with RENAME_EXCL, and Windows renames the retained directory handle through NtSetInformationFile. Publication never reopens the parent pathname. Directory identity is checked around pathname-based publication; concurrent publishers have one complete winner. Failure cleanup uses retained handles; crash leftovers under .pending-* are incomplete staging, not a published directory. A caller supplies and verifies its own completion manifest and content hashes. Process-restart recovery is distinct from guarantees about a host or storage device losing power; filesystem sync/rename errors propagate.

Node-API binaries implement root-handle-relative resolution, bounded snapshots and bounded traversal. No pathname-open JavaScript fallback is provided. Builds target glibc Linux x64/arm64, macOS x64/arm64 and Windows x64; Node 22/24.

The root is an object capability pinned at initialization. Concurrent writes are detected with before/after identity and metadata checks; this is not an atomic filesystem snapshot. Hard links and privileged mount changes are not separate filesystem security boundaries. Do not grant untrusted users privileges to mount filesystems over the configured root.

Prebuilds are generated by CI and included in the release tarball. Workspace builds require Node headers and a C++17 compiler. Windows builds also require the corresponding node.lib and the MSVC developer environment. Missing or unsupported binaries fail closed.

Ayrı çıktı yeteneği

openOutputRoot(sourceRoot, directory) mevcut, handle ile sabitlenmiş kaynak kökünün altındaki bir çıktı dizininden ayrı bir oluşturma yeteneği türetir. NativeRoot üzerinde yazma metodu bulunmaz. publish yalnızca düz dosya adlarını kabul eder; mevcut girdiyi değiştirmez. Baytlar asenkron işe geçmeden kopyalanır, geçici dosyada tamamlanır ve var olan hedefin üzerine yazılmadan yayımlanır. Bu işlem çok dosyalı bir işin tamamının atomik olduğu anlamına gelmez.

Yeni yüzey için platform binary dosyası yeniden derlenmelidir. Eski veya eksik binary dosyasında JavaScript dosya erişimine geri dönüş yapılmaz.