Folder streams and safe target directories

A native folder job consists of a bounded layout with paths, types, sizes and integrity data, plus the associated file bytes. The sender reads regular originals without creating a complete intermediate archive. Empty folders exist as directory entries in the layout. An explicit contents option sends the folder's contents without the outer folder.

The receiver works in a controlled location and checks paths, structure, contents and current rights. Symlinks, device files and arbitrary owner or ACL transfer are not part of the normal folder profile. A destination binds an optional alias to the local mapping managed by the receiver, and to a revision. The sender transmits no arbitrary absolute path that the server is supposed to act on unchecked.

Receiving a folder never overwrites or deletes by accident. The lower branches are different configured modes. A per-file atomic update is not automatically an atomic switch of the whole tree. A prepared folder state is activated only by a separate authorized action. Managed removal is in turn bound to its own set of files, rights, a review step or a limited CI policy, and a generation. Foreign files do not become a deletion target through an ordinary transfer.

On the receiver, the receiving area, the old state and quarantine can need additional space. Doing without a sender archive is no claim that no device needs additional storage. In the browser, a folder travels as a protected archive that pipeit prepares locally and unpacks for you on the receiving side. See Send a folder or only its contents and Store, update or activate a folder.