Crate rightkit_fs 

Safe filesystem state for Right Suite apps.

• [atomic]: temp + fsync + rename replacement, streaming writer, crash-orphan sweep. [atomic_write] is the one-call entry point.
• [lock]: OS advisory cross-process locks with owner/stale reporting. Two primitives: [FileLock::acquire] / [FileLock::try_acquire] take the exclusive lock, and [FileLock::acquire_shared] takes a shared (reader) lock. [LockKind] picks POSIX record locks (Fcntl, the default) or flock(2) (Flock) on Unix; [probe_owner] reads the owner record without locking.
• [write_locks] (feature lock): [KeyedWriteLocks], in-process write locks keyed by destination (directory identity plus name, nonexistent leaf allowed, no permanent map) with an optional cross-process lock file, to be used with [AtomicWriter].
• [transaction] (feature transaction): [FileTransaction] / [PreparedTransaction] / [recover_transactions], a crash-recoverable multi-file publication with a journal under the root (recoverability and serialized writers, not all-file atomic visibility).
• [transient] (feature fs): [transient::retry_transient], the one bounded retry (20 times, 100 ms apart, Windows only, the original error returned after the bound) for a delete, rename or open that Windows refuses with error 5, 32 or 33 while a scanner or indexer holds the file.
• [lease] (feature fs): [Lease], a pid + heartbeat-TTL lease file with stale-holder takeover (not an OS lock): try_acquire, renew, release, peek.
• [toolchain_lease] (feature toolchain-lease): [ToolchainLease], a digest-bound immutable seal of toolchain trees (hash once, freeze with the OS immutable flag, replay by metadata only).
• [migrate] (feature fs): [migrate_dir] (also AppDirs::migrate_dir), a directory move that never shows a half-migrated destination (rename, or copy to a sibling then rename).
• [app_dirs] (feature app-dirs): [AppDirs], one resolver for an app’s data, local, cache and home folders, with a dev namespace.
• [digest] (features digest / blake3): SHA-256 / BLAKE3 of bytes or files, & lowercase hex.
• plain: canonicalize_plain, std::fs::canonicalize without the Windows verbatim drive prefix.
• contain: is_within, contain(), contain_lenient and Roots, path containment that follows links but refuses to leave a root; with feature fs, [open_confined] / [Roots::open_confined], a no-follow open that stays inside the approved folders.
• [handle] (feature fs): [final_path] and [link_count] of an open file, and [open_read_nofollow].
• names: sanitize_file_name for names that come from outside, numbered_candidates, and with feature fs [create_unique_file] / [create_download_file].
• publish_dir (feature fs): publish_dir(), an atomic directory replace.
• [trash] (feature fs): [move_to_trash], and trash::{list, lookup, restore} (macOS, Windows and Linux).
• [journal] (feature lock): [JsonlJournal], an append journal that cuts a torn tail back.
• [retention], [confined_copy], [rename_case], [owned_temp], [malware_scan] (feature fs): a bounded set with all-or-nothing retirement, a link-refusing confined tree copy, a case-only rename, a temp for an external writer with a sweep, and an OS malware-scanner verdict.
• zip: StoredZipWriter, a deterministic stored-method ZIP writer, and crc32; also zip::{write_zip, read_zip, crc_table, crc32_update} for archives built from files on disk.
• [private]: owner-only files and directories (0600/0700, Windows DACL).
• [replaced]: [open_replaced] / [read_replaced], readers that retry, on Windows, an open a concurrent replace refused (access denied, sharing violation).
• [state]: [StateDir], a descriptor-pinned state directory (O_NOFOLLOW, fd-relative *at operations) that a swapped or symlinked path cannot redirect.
• [identity] (feature fs; the ledger [IdentityStore] needs json): stable file identity across renames and atomic replacement.
• [clone]: macOS clonefile(2) with CLONE_NOFOLLOW; [clone_file_nofollow] never falls back to a byte copy, [clone_or_link_or_copy_nofollow] tries clone, hard link, then copy.
• [swap]: macOS renamex_np(RENAME_SWAP); atomically exchanges two paths ([swap_paths]).

Re-exports

pub use contain::contain;

pub use contain::contain_lenient;

pub use contain::is_within;

pub use contain::ContainError;

pub use contain::Roots;

pub use names::is_windows_reserved_name;

pub use names::numbered_candidates;

pub use names::sanitize_file_name;

pub use names::sanitize_file_name_with;

pub use names::NameOptions;

pub use plain::canonicalize_plain;

pub use plain::plain_path;

pub use zip::crc32;

pub use zip::stored_zip_bytes;

pub use zip::StoredZipWriter;

Modules

contain

Path containment, one module: is a path inside a root, resolve a relative path under a root, and open a file under a root without following links.

names

File names that come from somewhere else: sanitising a download name and picking a free one.

plain

Canonical paths without the Windows \\?\ verbatim prefix.

zip

A deterministic ZIP writer that stores entries uncompressed.