Opens a path for reading without following a final symlink.
Must not block when the path is a FIFO or a device: a synchronous blocking open would stall the whole process. Must resolve the descriptor and its `fstat` facts as a single step.
Absolute path to open.
The open file, or a failure carrying the errno in status.
Reads an open descriptor as UTF-8, refusing to allocate past a cap.
The cap belongs here, with the read that does the allocating, rather than with an earlier size observation: a file can grow between being measured and being read.
Implementations must decode strictly and report `EILSEQ` rather than substituting for malformed bytes. Replacing them can turn a corrupted file into valid JSON holding a quietly altered credential, which the layer above would accept as healthy.
Descriptor previously returned by openForRead.
Largest payload to accept before failing with EFBIG.
The file contents, or a failure carrying the errno in status.
Restricts an open file to owner-only access.
Implementations must refuse when the inode carries more than one name, unless it is already owner-only and owned by this process. Permissions belong to the inode, not the name, so re-permissioning a hard-linked file would silently change a file the caller does not own. A private file needs no change, and IFileSystem.publishExclusive leaves one with two names until it removes the stage — for good if that removal fails.
Descriptor previously returned by openForRead.
The mode now in effect, or a failure explaining why it stands.
Releases a descriptor. Never throws, so it is safe in cleanup paths.
Descriptor previously returned by openForRead.
Whether the descriptor was released cleanly.
Creates a new file with owner-only permissions, failing if it exists.
Exclusive creation is what makes this safe for secrets: a plain write follows a symlink planted at the path and sends the payload somewhere else, and it also ignores the requested mode when the path already exists. `EEXIST` means the caller does not own the path and must not delete what is there.
Absolute path to create.
Payload to write, treated as opaque.
The bytes staged, or a failure carrying the errno in status.
Moves a path onto another, replacing the destination atomically.
Existing path to move.
Destination, replaced if it exists.
The destination path, or a failure carrying the errno.
Gives a staged file a final name only if that name is free, then removes the stage.
Unlike IFileSystem.rename, which replaces the destination, this never touches a taken name, so of two writers racing for one name exactly one wins and the other gets `EEXIST`. The final name is a second name for the finished file, so it appears with the whole contents or not at all, and a symlink already at the final name counts as taken rather than being followed. It needs a filesystem with hard links.
On failure the stage is left for the caller to remove. On success the stage is removed; if that removal fails, the file is still published and the stage is a leftover for the caller's sweep. Until then the file has two names, which IFileSystem.restrictToOwner accepts because both are owner-only and this process's own.
Finished file made by IFileSystem.createExclusive.
Name to publish it under, which must be free.
The final path, or a failure carrying the errno; EEXIST means
the name was taken.
Lists the full paths of everything directly inside a directory.
Full paths rather than bare names, so no caller has to join them and no caller can get the separator wrong on a foreign platform.
Directory to list.
The paths, or a failure carrying the errno in status.
Removes a path if present, reporting rather than throwing on failure.
Absolute path to remove.
Whether anything was deleted, or why the path remains.
Filesystem operations a secret-bearing store needs, and nothing more.