@bo-agent/sandbox-windows-acl 0.0.1

package/lib/.tsbuildinfo

@@ -0,0 +1 @@
+{"fileNames":["../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es5.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2016.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2018.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2019.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2021.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2023.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.dom.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.dom.iterable.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.dom.asynciterable.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.webworker.importscripts.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.scripthost.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.core.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.collection.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.generator.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.iterable.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.promise.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.proxy.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.reflect.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.symbol.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2015.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2016.array.include.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2016.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.arraybuffer.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.date.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.object.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.string.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2017.typedarrays.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2018.asyncgenerator.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2018.asynciterable.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2018.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2018.promise.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2018.regexp.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2019.array.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2019.object.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2019.string.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2019.symbol.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2019.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.bigint.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.date.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.promise.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.string.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.symbol.wellknown.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2020.number.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2021.promise.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2021.string.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2021.weakref.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2021.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.array.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.error.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.object.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.string.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2022.regexp.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2023.array.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2023.collection.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2023.intl.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.arraybuffer.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.collection.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.object.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.promise.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.regexp.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.sharedmemory.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.string.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.decorators.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.decorators.legacy.d.ts","../../../node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/lib.es2024.full.d.ts","../../../node_modules/.pnpm/koffi@3.2.1/node_modules/koffi/index.d.ts","../src/errors.ts","../src/win32-abi.ts","../src/ffi.ts","../src/acl.ts","../src/grant.ts","../src/path-boundary.ts","../src/spawn.ts","../src/token.ts","../src/workspace-sid.ts","../src/index.ts","../src/invariant.ts","../src/runner.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/compatibility/disposable.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/compatibility/indexable.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/compatibility/iterators.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/compatibility/index.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/globals.typedarray.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/buffer.buffer.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/globals.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/web-globals/abortcontroller.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/web-globals/domexception.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/web-globals/events.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/header.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/readable.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/file.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/fetch.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/formdata.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/connector.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/client.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/errors.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/dispatcher.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/global-dispatcher.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/global-origin.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/pool-stats.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/pool.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/handlers.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/balanced-pool.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/agent.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/mock-interceptor.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/mock-agent.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/mock-client.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/mock-pool.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/mock-errors.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/proxy-agent.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/env-http-proxy-agent.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/retry-handler.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/retry-agent.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/api.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/interceptors.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/util.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/cookies.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/patch.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/websocket.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/eventsource.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/filereader.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/diagnostics-channel.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/content-type.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/cache.d.ts","../../../node_modules/.pnpm/undici-types@6.21.0/node_modules/undici-types/index.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/web-globals/fetch.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/web-globals/navigator.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/web-globals/storage.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/web-globals/streams.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/assert.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/assert/strict.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/async_hooks.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/buffer.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/child_process.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/cluster.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/console.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/constants.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/crypto.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/dgram.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/diagnostics_channel.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/dns.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/dns/promises.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/domain.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/events.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/fs.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/fs/promises.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/http.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/http2.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/https.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/inspector.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/inspector.generated.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/module.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/net.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/os.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/path.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/perf_hooks.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/process.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/punycode.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/querystring.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/readline.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/readline/promises.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/repl.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/sea.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/sqlite.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/stream.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/stream/promises.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/stream/consumers.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/stream/web.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/string_decoder.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/test.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/timers.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/timers/promises.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/tls.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/trace_events.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/tty.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/url.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/util.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/v8.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/vm.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/wasi.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/worker_threads.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/zlib.d.ts","../../../node_modules/.pnpm/@types+node@22.20.2/node_modules/@types/node/index.d.ts"],"fileIdsList":[[94,140,141,143,160,161],[94,142,143,160,161],[143,160,161],[94,143,148,160,161,178],[94,143,144,149,154,160,161,163,175,186],[94,143,144,145,154,160,161,163],[94,143,160,161],[89,90,91,94,143,160,161],[94,143,146,160,161,187],[94,143,147,148,155,160,161,164],[94,143,148,160,161,175,183],[94,143,149,151,154,160,161,163],[94,142,143,150,160,161],[94,143,151,152,160,161],[94,143,153,154,160,161],[94,142,143,154,160,161],[94,143,154,155,156,160,161,175,186],[94,143,154,155,156,160,161,170,175,178],[94,135,143,151,154,157,160,161,163,175,186],[94,143,154,155,157,158,160,161,163,175,183,186],[94,143,157,159,160,161,175,183,186],[92,93,94,95,96,97,98,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192],[94,143,154,160,161],[94,143,160,161,162,186],[94,143,151,154,160,161,163,175],[94,143,160,161,164],[94,143,160,161,165],[94,142,143,160,161,166],[94,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192],[94,143,160,161,168],[94,143,160,161,169],[94,143,154,160,161,170,171],[94,143,160,161,170,172,187,189],[94,143,155,160,161],[94,143,154,160,161,175,176,178],[94,143,160,161,177,178],[94,143,160,161,175,176],[94,143,160,161,178],[94,143,160,161,179],[94,140,143,160,161,175,180,186],[94,143,154,160,161,181,182],[94,143,160,161,181,182],[94,143,148,160,161,163,175,183],[94,143,160,161,184],[94,143,160,161,163,185],[94,143,157,160,161,169,186],[94,143,148,160,161,187],[94,143,160,161,175,188],[94,143,160,161,162,189],[94,143,160,161,190],[94,135,143,160,161],[94,135,143,154,156,160,161,166,175,178,186,188,189,191],[94,143,160,161,175,192],[94,107,111,143,160,161,186],[94,107,143,160,161,175,186],[94,102,143,160,161],[94,104,107,143,160,161,183,186],[94,143,160,161,163,183],[94,143,160,161,193],[94,102,143,160,161,193],[94,104,107,143,160,161,163,186],[94,99,100,103,106,143,154,160,161,175,186],[94,107,114,143,160,161],[94,99,105,143,160,161],[94,107,128,129,143,160,161],[94,103,107,143,160,161,178,186,193],[94,128,143,160,161,193],[94,101,102,143,160,161,193],[94,107,143,160,161],[94,101,102,103,104,105,106,107,108,109,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,129,130,131,132,133,134,143,160,161],[94,107,122,143,160,161],[94,107,114,115,143,160,161],[94,105,107,115,116,143,160,161],[94,106,143,160,161],[94,99,102,107,143,160,161],[94,107,111,115,116,143,160,161],[94,111,143,160,161],[94,105,107,110,143,160,161,186],[94,99,104,107,114,143,160,161],[94,143,160,161,175],[94,102,107,128,143,160,161,191,193],[78,79,94,143,148,155,160,161,165],[76,77,78,94,143,160,161],[79,80,94,143,160,161],[77,78,79,80,81,82,83,84,85,94,143,155,160,161,165],[94,143,155,160,161,165],[79,85,86,94,143,155,160,161,165],[78,79,94,143,160,161],[78,79,80,94,143,160,161],[94,143,148,160,161]],"fileInfos":[{"version":"c430d44666289dae81f30fa7b2edebf186ecc91a2d4c71266ea6ae76388792e1","affectsGlobalScope":true,"impliedFormat":1},{"version":"45b7ab580deca34ae9729e97c13cfd999df04416a79116c3bfb483804f85ded4","impliedFormat":1},{"version":"3facaf05f0c5fc569c5649dd359892c98a85557e3e0c847964caeb67076f4d75","impliedFormat":1},{"version":"e44bb8bbac7f10ecc786703fe0a6a4b952189f908707980ba8f3c8975a760962","impliedFormat":1},{"version":"5e1c4c362065a6b95ff952c0eab010f04dcd2c3494e813b493ecfd4fcb9fc0d8","impliedFormat":1},{"version":"68d73b4a11549f9c0b7d352d10e91e5dca8faa3322bfb77b661839c42b1ddec7","impliedFormat":1},{"version":"5efce4fc3c29ea84e8928f97adec086e3dc876365e0982cc8479a07954a3efd4","impliedFormat":1},{"version":"feecb1be483ed332fad555aff858affd90a48ab19ba7272ee084704eb7167569","impliedFormat":1},{"version":"ee7bad0c15b58988daa84371e0b89d313b762ab83cb5b31b8a2d1162e8eb41c2","impliedFormat":1},{"version":"27bdc30a0e32783366a5abeda841bc22757c1797de8681bbe81fbc735eeb1c10","impliedFormat":1},{"version":"8fd575e12870e9944c7e1d62e1f5a73fcf23dd8d3a321f2a2c74c20d022283fe","impliedFormat":1},{"version":"080941d9f9ff9307f7e27a83bcd888b7c8270716c39af943532438932ec1d0b9","affectsGlobalScope":true,"impliedFormat":1},{"version":"2e80ee7a49e8ac312cc11b77f1475804bee36b3b2bc896bead8b6e1266befb43","affectsGlobalScope":true,"impliedFormat":1},{"version":"d7a3c8b952931daebdfc7a2897c53c0a1c73624593fa070e46bd537e64dcd20a","affectsGlobalScope":true,"impliedFormat":1},{"version":"80e18897e5884b6723488d4f5652167e7bb5024f946743134ecc4aa4ee731f89","affectsGlobalScope":true,"impliedFormat":1},{"version":"cd034f499c6cdca722b60c04b5b1b78e058487a7085a8e0d6fb50809947ee573","affectsGlobalScope":true,"impliedFormat":1},{"version":"c57796738e7f83dbc4b8e65132f11a377649c00dd3eee333f672b8f0a6bea671","affectsGlobalScope":true,"impliedFormat":1},{"version":"dc2df20b1bcdc8c2d34af4926e2c3ab15ffe1160a63e58b7e09833f616efff44","affectsGlobalScope":true,"impliedFormat":1},{"version":"515d0b7b9bea2e31ea4ec968e9edd2c39d3eebf4a2d5cbd04e88639819ae3b71","affectsGlobalScope":true,"impliedFormat":1},{"version":"0559b1f683ac7505ae451f9a96ce4c3c92bdc71411651ca6ddb0e88baaaad6a3","affectsGlobalScope":true,"impliedFormat":1},{"version":"0dc1e7ceda9b8b9b455c3a2d67b0412feab00bd2f66656cd8850e8831b08b537","affectsGlobalScope":true,"impliedFormat":1},{"version":"ce691fb9e5c64efb9547083e4a34091bcbe5bdb41027e310ebba8f7d96a98671","affectsGlobalScope":true,"impliedFormat":1},{"version":"8d697a2a929a5fcb38b7a65594020fcef05ec1630804a33748829c5ff53640d0","affectsGlobalScope":true,"impliedFormat":1},{"version":"4ff2a353abf8a80ee399af572debb8faab2d33ad38c4b4474cff7f26e7653b8d","affectsGlobalScope":true,"impliedFormat":1},{"version":"fb0f136d372979348d59b3f5020b4cdb81b5504192b1cacff5d1fbba29378aa1","affectsGlobalScope":true,"impliedFormat":1},{"version":"d15bea3d62cbbdb9797079416b8ac375ae99162a7fba5de2c6c505446486ac0a","affectsGlobalScope":true,"impliedFormat":1},{"version":"68d18b664c9d32a7336a70235958b8997ebc1c3b8505f4f1ae2b7e7753b87618","affectsGlobalScope":true,"impliedFormat":1},{"version":"eb3d66c8327153d8fa7dd03f9c58d351107fe824c79e9b56b462935176cdf12a","affectsGlobalScope":true,"impliedFormat":1},{"version":"38f0219c9e23c915ef9790ab1d680440d95419ad264816fa15009a8851e79119","affectsGlobalScope":true,"impliedFormat":1},{"version":"69ab18c3b76cd9b1be3d188eaf8bba06112ebbe2f47f6c322b5105a6fbc45a2e","affectsGlobalScope":true,"impliedFormat":1},{"version":"a680117f487a4d2f30ea46f1b4b7f58bef1480456e18ba53ee85c2746eeca012","affectsGlobalScope":true,"impliedFormat":1},{"version":"2f11ff796926e0832f9ae148008138ad583bd181899ab7dd768a2666700b1893","affectsGlobalScope":true,"impliedFormat":1},{"version":"4de680d5bb41c17f7f68e0419412ca23c98d5749dcaaea1896172f06435891fc","affectsGlobalScope":true,"impliedFormat":1},{"version":"954296b30da6d508a104a3a0b5d96b76495c709785c1d11610908e63481ee667","affectsGlobalScope":true,"impliedFormat":1},{"version":"ac9538681b19688c8eae65811b329d3744af679e0bdfa5d842d0e32524c73e1c","affectsGlobalScope":true,"impliedFormat":1},{"version":"0a969edff4bd52585473d24995c5ef223f6652d6ef46193309b3921d65dd4376","affectsGlobalScope":true,"impliedFormat":1},{"version":"9e9fbd7030c440b33d021da145d3232984c8bb7916f277e8ffd3dc2e3eae2bdb","affectsGlobalScope":true,"impliedFormat":1},{"version":"811ec78f7fefcabbda4bfa93b3eb67d9ae166ef95f9bff989d964061cbf81a0c","affectsGlobalScope":true,"impliedFormat":1},{"version":"717937616a17072082152a2ef351cb51f98802fb4b2fdabd32399843875974ca","affectsGlobalScope":true,"impliedFormat":1},{"version":"d7e7d9b7b50e5f22c915b525acc5a49a7a6584cf8f62d0569e557c5cfc4b2ac2","affectsGlobalScope":true,"impliedFormat":1},{"version":"71c37f4c9543f31dfced6c7840e068c5a5aacb7b89111a4364b1d5276b852557","affectsGlobalScope":true,"impliedFormat":1},{"version":"576711e016cf4f1804676043e6a0a5414252560eb57de9faceee34d79798c850","affectsGlobalScope":true,"impliedFormat":1},{"version":"89c1b1281ba7b8a96efc676b11b264de7a8374c5ea1e6617f11880a13fc56dc6","affectsGlobalScope":true,"impliedFormat":1},{"version":"74f7fa2d027d5b33eb0471c8e82a6c87216223181ec31247c357a3e8e2fddc5b","affectsGlobalScope":true,"impliedFormat":1},{"version":"d6d7ae4d1f1f3772e2a3cde568ed08991a8ae34a080ff1151af28b7f798e22ca","affectsGlobalScope":true,"impliedFormat":1},{"version":"063600664504610fe3e99b717a1223f8b1900087fab0b4cad1496a114744f8df","affectsGlobalScope":true,"impliedFormat":1},{"version":"934019d7e3c81950f9a8426d093458b65d5aff2c7c1511233c0fd5b941e608ab","affectsGlobalScope":true,"impliedFormat":1},{"version":"52ada8e0b6e0482b728070b7639ee42e83a9b1c22d205992756fe020fd9f4a47","affectsGlobalScope":true,"impliedFormat":1},{"version":"3bdefe1bfd4d6dee0e26f928f93ccc128f1b64d5d501ff4a8cf3c6371200e5e6","affectsGlobalScope":true,"impliedFormat":1},{"version":"59fb2c069260b4ba00b5643b907ef5d5341b167e7d1dbf58dfd895658bda2867","affectsGlobalScope":true,"impliedFormat":1},{"version":"639e512c0dfc3fad96a84caad71b8834d66329a1f28dc95e3946c9b58176c73a","affectsGlobalScope":true,"impliedFormat":1},{"version":"368af93f74c9c932edd84c58883e736c9e3d53cec1fe24c0b0ff451f529ceab1","affectsGlobalScope":true,"impliedFormat":1},{"version":"af3dd424cf267428f30ccfc376f47a2c0114546b55c44d8c0f1d57d841e28d74","affectsGlobalScope":true,"impliedFormat":1},{"version":"995c005ab91a498455ea8dfb63aa9f83fa2ea793c3d8aa344be4a1678d06d399","affectsGlobalScope":true,"impliedFormat":1},{"version":"959d36cddf5e7d572a65045b876f2956c973a586da58e5d26cde519184fd9b8a","affectsGlobalScope":true,"impliedFormat":1},{"version":"965f36eae237dd74e6cca203a43e9ca801ce38824ead814728a2807b1910117d","affectsGlobalScope":true,"impliedFormat":1},{"version":"3925a6c820dcb1a06506c90b1577db1fdbf7705d65b62b99dce4be75c637e26b","affectsGlobalScope":true,"impliedFormat":1},{"version":"0a3d63ef2b853447ec4f749d3f368ce642264246e02911fcb1590d8c161b8005","affectsGlobalScope":true,"impliedFormat":1},{"version":"8cdf8847677ac7d20486e54dd3fcf09eda95812ac8ace44b4418da1bbbab6eb8","affectsGlobalScope":true,"impliedFormat":1},{"version":"8444af78980e3b20b49324f4a16ba35024fef3ee069a0eb67616ea6ca821c47a","affectsGlobalScope":true,"impliedFormat":1},{"version":"3287d9d085fbd618c3971944b65b4be57859f5415f495b33a6adc994edd2f004","affectsGlobalScope":true,"impliedFormat":1},{"version":"b4b67b1a91182421f5df999988c690f14d813b9850b40acd06ed44691f6727ad","affectsGlobalScope":true,"impliedFormat":1},{"version":"df83c2a6c73228b625b0beb6669c7ee2a09c914637e2d35170723ad49c0f5cd4","affectsGlobalScope":true,"impliedFormat":1},{"version":"436aaf437562f276ec2ddbee2f2cdedac7664c1e4c1d2c36839ddd582eeb3d0a","affectsGlobalScope":true,"impliedFormat":1},{"version":"8e3c06ea092138bf9fa5e874a1fdbc9d54805d074bee1de31b99a11e2fec239d","affectsGlobalScope":true,"impliedFormat":1},{"version":"87dc0f382502f5bbce5129bdc0aea21e19a3abbc19259e0b43ae038a9fc4e326","affectsGlobalScope":true,"impliedFormat":1},{"version":"b1cb28af0c891c8c96b2d6b7be76bd394fddcfdb4709a20ba05a7c1605eea0f9","affectsGlobalScope":true,"impliedFormat":1},{"version":"2fef54945a13095fdb9b84f705f2b5994597640c46afeb2ce78352fab4cb3279","affectsGlobalScope":true,"impliedFormat":1},{"version":"ac77cb3e8c6d3565793eb90a8373ee8033146315a3dbead3bde8db5eaf5e5ec6","affectsGlobalScope":true,"impliedFormat":1},{"version":"56e4ed5aab5f5920980066a9409bfaf53e6d21d3f8d020c17e4de584d29600ad","affectsGlobalScope":true,"impliedFormat":1},{"version":"4ece9f17b3866cc077099c73f4983bddbcb1dc7ddb943227f1ec070f529dedd1","affectsGlobalScope":true,"impliedFormat":1},{"version":"0a6282c8827e4b9a95f4bf4f5c205673ada31b982f50572d27103df8ceb8013c","affectsGlobalScope":true,"impliedFormat":1},{"version":"8e7f8264d0fb4c5339605a15daadb037bf238c10b654bb3eee14208f860a32ea","affectsGlobalScope":true,"impliedFormat":1},{"version":"782dec38049b92d4e85c1585fbea5474a219c6984a35b004963b00beb1aab538","affectsGlobalScope":true,"impliedFormat":1},{"version":"b3e9cef4eed59f8a2249ed834ba4aabe9d0d4e9037d4679487fa17dad99004a3","impliedFormat":1},{"version":"b4f749b16500797d1f0e9ed0f04e08e1b162cfbaf48e3efbacee8f27182b4ad1","impliedFormat":99},{"version":"c6685a0f307f21d88e473dc6d2280ccdff1db6a3c70c475a26376cdca227b855","signature":"a12f2c28fcf2c4702df1f423d87d18dd70f4553a07f86a05d73b9a5ced1e4b5d"},{"version":"28b5fc6dc9bcf8971161edab6b839e6499acd2e3f82f07fd2b0e8924013608db","signature":"6944b6d1ad7d548c7701c1a63320f676b7ba6f0d1faec63cb2d11548aad4a0ec"},{"version":"96df3ce76c2a7a29da944c83448c8c180af579a95e86a3557792d86adcde679b","signature":"ea06a43414e727e635a61d87a117c2a3a086869b911b78bd38d3830c042ed162"},{"version":"aeba833cc236d11f9a45c8cf824c14174a32a274f18d45ea0fc0edc91a37a247","signature":"1842f62cb7349829be2a126c450ed14488a5f5aeafc33a88ab9e61f4cf12ea44"},{"version":"0858f2f4b02ec77a9ecf0762d39fad0bcf5f0d9bc5d1c9f58666347128072c3d","signature":"952f8bc7fe35a291be5883f15c3b4ccbbe7b41c077461e2d587df563b102950c"},{"version":"72fc03b02aab449aaa72a47f52ca8417146ba8eaed816f196446fe98e7fef234","signature":"599a509f3547eb349b35c6761a639493eaa3095e39fde8cdee2ee2264c06f457"},{"version":"29919c38b04bfda108c1e3b16f6f459b17deea3c77c7b69d9b42964233b71303","signature":"3f1bc0c48c0601694ff480d5160992355fd989557f121b30e27eb60e2eb77f3d"},{"version":"bc60b299a3de80a0e418867f8f0b4a3185990755a29158628266972736e01f59","signature":"ddc1f1aefc0053f86c95f0977450090c7dad1d861cc4cf70fc971710cff12f52"},{"version":"e7a0ab56e4a4ed97d62b28248c047eee42673d103dbcb63c9dcd85552cd924ad","signature":"63e8e0876f60c128e25ef0f08ea7cd60327b197297039f903ac7e4efb38b47e6"},{"version":"5883d76881f9ba8abacb1846b2458b6cd59a181f2064be5e24c3b994802d460d","signature":"f18c705ec1dc13d09c68cec1be3329bee7c602c7d6f7f3ee62575647f58e12cf"},{"version":"41f0cbbfa79daf8f7fc87d84a4cdbf096e3ca9209ab248cf4d70a7148b216619","signature":"1431baf58300f71b0ab17cc069cb3e9b2af4af81e04ba28221aa683ef83bd0f9"},{"version":"fed16ce407106ac496d34c1599d983403edf1566b696d6476976087d59a7ee79","signature":"abdd3f2f3bf5decb56b6be0df80060737ed25873af05ec1bb347786ef2b54d9f"},{"version":"6c7176368037af28cb72f2392010fa1cef295d6d6744bca8cfb54985f3a18c3e","affectsGlobalScope":true,"impliedFormat":1},{"version":"ab41ef1f2cdafb8df48be20cd969d875602483859dc194e9c97c8a576892c052","affectsGlobalScope":true,"impliedFormat":1},{"version":"437e20f2ba32abaeb7985e0afe0002de1917bc74e949ba585e49feba65da6ca1","affectsGlobalScope":true,"impliedFormat":1},{"version":"21d819c173c0cf7cc3ce57c3276e77fd9a8a01d35a06ad87158781515c9a438a","impliedFormat":1},{"version":"98cffbf06d6bab333473c70a893770dbe990783904002c4f1a960447b4b53dca","affectsGlobalScope":true,"impliedFormat":1},{"version":"3af97acf03cc97de58a3a4bc91f8f616408099bc4233f6d0852e72a8ffb91ac9","affectsGlobalScope":true,"impliedFormat":1},{"version":"808069bba06b6768b62fd22429b53362e7af342da4a236ed2d2e1c89fcca3b4a","affectsGlobalScope":true,"impliedFormat":1},{"version":"1db0b7dca579049ca4193d034d835f6bfe73096c73663e5ef9a0b5779939f3d0","affectsGlobalScope":true,"impliedFormat":1},{"version":"9798340ffb0d067d69b1ae5b32faa17ab31b82466a3fc00d8f2f2df0c8554aaa","affectsGlobalScope":true,"impliedFormat":1},{"version":"f26b11d8d8e4b8028f1c7d618b22274c892e4b0ef5b3678a8ccbad85419aef43","affectsGlobalScope":true,"impliedFormat":1},{"version":"5929864ce17fba74232584d90cb721a89b7ad277220627cc97054ba15a98ea8f","impliedFormat":1},{"version":"763fe0f42b3d79b440a9b6e51e9ba3f3f91352469c1e4b3b67bfa4ff6352f3f4","impliedFormat":1},{"version":"25c8056edf4314820382a5fdb4bb7816999acdcb929c8f75e3f39473b87e85bc","impliedFormat":1},{"version":"c464d66b20788266e5353b48dc4aa6bc0dc4a707276df1e7152ab0c9ae21fad8","impliedFormat":1},{"version":"78d0d27c130d35c60b5e5566c9f1e5be77caf39804636bc1a40133919a949f21","impliedFormat":1},{"version":"c6fd2c5a395f2432786c9cb8deb870b9b0e8ff7e22c029954fabdd692bff6195","impliedFormat":1},{"version":"1d6e127068ea8e104a912e42fc0a110e2aa5a66a356a917a163e8cf9a65e4a75","impliedFormat":1},{"version":"5ded6427296cdf3b9542de4471d2aa8d3983671d4cac0f4bf9c637208d1ced43","impliedFormat":1},{"version":"7f182617db458e98fc18dfb272d40aa2fff3a353c44a89b2c0ccb3937709bfb5","impliedFormat":1},{"version":"cadc8aced301244057c4e7e73fbcae534b0f5b12a37b150d80e5a45aa4bebcbd","impliedFormat":1},{"version":"385aab901643aa54e1c36f5ef3107913b10d1b5bb8cbcd933d4263b80a0d7f20","impliedFormat":1},{"version":"9670d44354bab9d9982eca21945686b5c24a3f893db73c0dae0fd74217a4c219","impliedFormat":1},{"version":"0b8a9268adaf4da35e7fa830c8981cfa22adbbe5b3f6f5ab91f6658899e657a7","impliedFormat":1},{"version":"11396ed8a44c02ab9798b7dca436009f866e8dae3c9c25e8c1fbc396880bf1bb","impliedFormat":1},{"version":"ba7bc87d01492633cb5a0e5da8a4a42a1c86270e7b3d2dea5d156828a84e4882","impliedFormat":1},{"version":"4893a895ea92c85345017a04ed427cbd6a1710453338df26881a6019432febdd","impliedFormat":1},{"version":"c21dc52e277bcfc75fac0436ccb75c204f9e1b3fa5e12729670910639f27343e","impliedFormat":1},{"version":"13f6f39e12b1518c6650bbb220c8985999020fe0f21d818e28f512b7771d00f9","impliedFormat":1},{"version":"9b5369969f6e7175740bf51223112ff209f94ba43ecd3bb09eefff9fd675624a","impliedFormat":1},{"version":"4fe9e626e7164748e8769bbf74b538e09607f07ed17c2f20af8d680ee49fc1da","impliedFormat":1},{"version":"24515859bc0b836719105bb6cc3d68255042a9f02a6022b3187948b204946bd2","impliedFormat":1},{"version":"ea0148f897b45a76544ae179784c95af1bd6721b8610af9ffa467a518a086a43","impliedFormat":1},{"version":"24c6a117721e606c9984335f71711877293a9651e44f59f3d21c1ea0856f9cc9","impliedFormat":1},{"version":"dd3273ead9fbde62a72949c97dbec2247ea08e0c6952e701a483d74ef92d6a17","impliedFormat":1},{"version":"405822be75ad3e4d162e07439bac80c6bcc6dbae1929e179cf467ec0b9ee4e2e","impliedFormat":1},{"version":"0db18c6e78ea846316c012478888f33c11ffadab9efd1cc8bcc12daded7a60b6","impliedFormat":1},{"version":"e61be3f894b41b7baa1fbd6a66893f2579bfad01d208b4ff61daef21493ef0a8","impliedFormat":1},{"version":"bd0532fd6556073727d28da0edfd1736417a3f9f394877b6d5ef6ad88fba1d1a","impliedFormat":1},{"version":"89167d696a849fce5ca508032aabfe901c0868f833a8625d5a9c6e861ef935d2","impliedFormat":1},{"version":"615ba88d0128ed16bf83ef8ccbb6aff05c3ee2db1cc0f89ab50a4939bfc1943f","impliedFormat":1},{"version":"a4d551dbf8746780194d550c88f26cf937caf8d56f102969a110cfaed4b06656","impliedFormat":1},{"version":"8bd86b8e8f6a6aa6c49b71e14c4ffe1211a0e97c80f08d2c8cc98838006e4b88","impliedFormat":1},{"version":"317e63deeb21ac07f3992f5b50cdca8338f10acd4fbb7257ebf56735bf52ab00","impliedFormat":1},{"version":"4732aec92b20fb28c5fe9ad99521fb59974289ed1e45aecb282616202184064f","impliedFormat":1},{"version":"2e85db9e6fd73cfa3d7f28e0ab6b55417ea18931423bd47b409a96e4a169e8e6","impliedFormat":1},{"version":"c46e079fe54c76f95c67fb89081b3e399da2c7d109e7dca8e4b58d83e332e605","impliedFormat":1},{"version":"bf67d53d168abc1298888693338cb82854bdb2e69ef83f8a0092093c2d562107","impliedFormat":1},{"version":"b52476feb4a0cbcb25e5931b930fc73cb6643fb1a5060bf8a3dda0eeae5b4b68","affectsGlobalScope":true,"impliedFormat":1},{"version":"f9501cc13ce624c72b61f12b3963e84fad210fbdf0ffbc4590e08460a3f04eba","affectsGlobalScope":true,"impliedFormat":1},{"version":"e7721c4f69f93c91360c26a0a84ee885997d748237ef78ef665b153e622b36c1","affectsGlobalScope":true,"impliedFormat":1},{"version":"d97fb21da858fb18b8ae72c314e9743fd52f73ebe2764e12af1db32fc03f853f","affectsGlobalScope":true,"impliedFormat":1},{"version":"0fa06ada475b910e2106c98c68b10483dc8811d0c14a8a8dd36efb2672485b29","impliedFormat":1},{"version":"33e5e9aba62c3193d10d1d33ae1fa75c46a1171cf76fef750777377d53b0303f","impliedFormat":1},{"version":"2b06b93fd01bcd49d1a6bd1f9b65ddcae6480b9a86e9061634d6f8e354c1468f","impliedFormat":1},{"version":"6a0cd27e5dc2cfbe039e731cf879d12b0e2dded06d1b1dedad07f7712de0d7f4","affectsGlobalScope":true,"impliedFormat":1},{"version":"13f5c844119c43e51ce777c509267f14d6aaf31eafb2c2b002ca35584cd13b29","impliedFormat":1},{"version":"e60477649d6ad21542bd2dc7e3d9ff6853d0797ba9f689ba2f6653818999c264","impliedFormat":1},{"version":"c2510f124c0293ab80b1777c44d80f812b75612f297b9857406468c0f4dafe29","affectsGlobalScope":true,"impliedFormat":1},{"version":"5524481e56c48ff486f42926778c0a3cce1cc85dc46683b92b1271865bcf015a","impliedFormat":1},{"version":"4c829ab315f57c5442c6667b53769975acbf92003a66aef19bce151987675bd1","affectsGlobalScope":true,"impliedFormat":1},{"version":"b2ade7657e2db96d18315694789eff2ddd3d8aea7215b181f8a0b303277cc579","impliedFormat":1},{"version":"78dbea00e90d2df8ea3dbef0cc379d95b8be9b71cd6bde4c28728f306811803b","impliedFormat":1},{"version":"4d631b81fa2f07a0e63a9a143d6a82c25c5f051298651a9b69176ba28930756d","impliedFormat":1},{"version":"836a356aae992ff3c28a0212e3eabcb76dd4b0cc06bcb9607aeef560661b860d","impliedFormat":1},{"version":"1e0d1f8b0adfa0b0330e028c7941b5a98c08b600efe7f14d2d2a00854fb2f393","impliedFormat":1},{"version":"41670ee38943d9cbb4924e436f56fc19ee94232bc96108562de1a734af20dc2c","affectsGlobalScope":true,"impliedFormat":1},{"version":"8e1e46d0a9837ee058c100501080c920fa98081ea3956af0374308ba6f22a33e","impliedFormat":1},{"version":"272ca407e0c9068bdc5152552d876e68037ceae3de62e529306403e973dec8e1","impliedFormat":1},{"version":"fa7834c715d5357e4540cee40ce96c3250ddb67a7b879a6b7fa0e86d6696f121","impliedFormat":1},{"version":"22dfb07a7ab15b66ac043829056fe70124844636ae719551812ac631ba04985b","impliedFormat":1},{"version":"a10f0e1854f3316d7ee437b79649e5a6ae3ae14ffe6322b02d4987071a95362e","impliedFormat":1},{"version":"e208f73ef6a980104304b0d2ca5f6bf1b85de6009d2c7e404028b875020fa8f2","impliedFormat":1},{"version":"d163b6bc2372b4f07260747cbc6c0a6405ab3fbcea3852305e98ac43ca59f5bc","impliedFormat":1},{"version":"e6fa9ad47c5f71ff733744a029d1dc472c618de53804eae08ffc243b936f87ff","affectsGlobalScope":true,"impliedFormat":1},{"version":"a6f137d651076822d4fe884287e68fd61785a0d3d1fdb250a5059b691fa897db","impliedFormat":1},{"version":"24826ed94a78d5c64bd857570fdbd96229ad41b5cb654c08d75a9845e3ab7dde","impliedFormat":1},{"version":"8b479a130ccb62e98f11f136d3ac80f2984fdc07616516d29881f3061f2dd472","impliedFormat":1},{"version":"928af3d90454bf656a52a48679f199f64c1435247d6189d1caf4c68f2eaf921f","affectsGlobalScope":true,"impliedFormat":1},{"version":"bceb58df66ab8fb00170df20cd813978c5ab84be1d285710c4eb005d8e9d8efb","affectsGlobalScope":true,"impliedFormat":1},{"version":"3f16a7e4deafa527ed9995a772bb380eb7d3c2c0fd4ae178c5263ed18394db2c","impliedFormat":1},{"version":"933921f0bb0ec12ef45d1062a1fc0f27635318f4d294e4d99de9a5493e618ca2","impliedFormat":1},{"version":"71a0f3ad612c123b57239a7749770017ecfe6b66411488000aba83e4546fde25","impliedFormat":1},{"version":"77fbe5eecb6fac4b6242bbf6eebfc43e98ce5ccba8fa44e0ef6a95c945ff4d98","impliedFormat":1},{"version":"4f9d8ca0c417b67b69eeb54c7ca1bedd7b56034bb9bfd27c5d4f3bc4692daca7","impliedFormat":1},{"version":"0cb167c371eaa8c869f8a7656a7296f2e4fae43b4d8b803a680236b24794e5f9","impliedFormat":1},{"version":"0a839dba0287cc0481ad4beedd48a1c64acf1e212ae865d1315f7007ca215161","impliedFormat":1},{"version":"38dc4655376cd1a4bd6bb3763d92949233e33d38d3dd3cbea7bbf218175a38ef","impliedFormat":1},{"version":"37ba7b45141a45ce6e80e66f2a96c8a5ab1bcef0fc2d0f56bb58df96ec67e972","impliedFormat":1},{"version":"45650f47bfb376c8a8ed39d4bcda5902ab899a3150029684ee4c10676d9fbaee","impliedFormat":1},{"version":"208a6a0bfb227bdf8fb964799d0a206c75cf03ccd72e63bf5495c9331354c6d6","affectsGlobalScope":true,"impliedFormat":1},{"version":"18fd40412d102c5564136f29735e5d1c3b455b8a37f920da79561f1fde068208","impliedFormat":1},{"version":"48a679952eefe4cb776d5a0e1ccba2d3eb53b57448bbb7abc1fcebcbd5440188","impliedFormat":1},{"version":"f0be1b8078cd549d91f37c30c222c2a187ac1cf981d994fb476a1adc61387b14","affectsGlobalScope":true,"impliedFormat":1},{"version":"0aaed1d72199b01234152f7a60046bc947f1f37d78d182e9ae09c4289e06a592","impliedFormat":1},{"version":"2d14da6ecb49bf828d83948765ec2d3a579d476bbb9645e749610baa6ec880ca","impliedFormat":1},{"version":"66ba1b2c3e3a3644a1011cd530fb444a96b1b2dfe2f5e837a002d41a1a799e60","impliedFormat":1},{"version":"7e514f5b852fdbc166b539fdd1f4e9114f29911592a5eb10a94bb3a13ccac3c4","impliedFormat":1},{"version":"5b7aa3c4c1a5d81b411e8cb302b45507fea9358d3569196b27eb1a27ae3a90ef","affectsGlobalScope":true,"impliedFormat":1},{"version":"5987a903da92c7462e0b35704ce7da94d7fdc4b89a984871c0e2b87a8aae9e69","affectsGlobalScope":true,"impliedFormat":1},{"version":"ea08a0345023ade2b47fbff5a76d0d0ed8bff10bc9d22b83f40858a8e941501c","impliedFormat":1},{"version":"0aef708fb4c7a6b915e8305cbfac40cd207b032dbaabe9a01889a5fff3254681","impliedFormat":1},{"version":"ae062ce7d9510060c5d7e7952ae379224fb3f8f2dd74e88959878af2057c143b","impliedFormat":1},{"version":"ad9bdafb4e7abf14cc53ce7970486a84c87831e62891e5dfe798ddcd55e84701","affectsGlobalScope":true,"impliedFormat":1},{"version":"358765d5ea8afd285d4fd1532e78b88273f18cb3f87403a9b16fef61ac9fdcfe","impliedFormat":1},{"version":"71d3ae6a5e73ca4130762560425e00984ebaff64d5353a3333d1bb7eb86ef336","impliedFormat":1}],"root":[[77,88]],"options":{"allowImportingTsExtensions":true,"composite":true,"declaration":true,"declarationMap":true,"esModuleInterop":true,"exactOptionalPropertyTypes":true,"module":99,"noFallthroughCasesInSwitch":true,"noImplicitOverride":true,"noUncheckedIndexedAccess":true,"noUnusedLocals":false,"noUnusedParameters":false,"outDir":"./","rewriteRelativeImportExtensions":true,"rootDir":"../src","skipLibCheck":true,"sourceMap":true,"strict":true,"target":11,"tsBuildInfoFile":"./.tsbuildinfo","verbatimModuleSyntax":false},"referencedMap":[[140,1],[141,1],[142,2],[94,3],[143,4],[144,5],[145,6],[89,7],[92,8],[90,7],[91,7],[146,9],[147,10],[148,11],[149,12],[150,13],[151,14],[152,14],[153,15],[154,16],[155,17],[156,18],[95,7],[93,7],[157,19],[158,20],[159,21],[193,22],[160,23],[161,7],[162,24],[163,25],[164,26],[165,27],[166,28],[167,29],[168,30],[169,31],[170,32],[171,32],[172,33],[173,7],[174,34],[175,35],[177,36],[176,37],[178,38],[179,39],[180,40],[181,41],[182,42],[183,43],[184,44],[185,45],[186,46],[187,47],[188,48],[189,49],[190,50],[96,7],[97,7],[98,7],[136,51],[137,7],[138,7],[139,38],[191,52],[192,53],[76,7],[73,7],[74,7],[14,7],[12,7],[13,7],[18,7],[17,7],[2,7],[19,7],[20,7],[21,7],[22,7],[23,7],[24,7],[25,7],[26,7],[3,7],[27,7],[28,7],[4,7],[29,7],[33,7],[30,7],[31,7],[32,7],[34,7],[35,7],[36,7],[5,7],[37,7],[38,7],[39,7],[40,7],[6,7],[44,7],[41,7],[42,7],[43,7],[45,7],[7,7],[46,7],[51,7],[52,7],[47,7],[48,7],[49,7],[50,7],[8,7],[56,7],[53,7],[54,7],[55,7],[57,7],[9,7],[58,7],[59,7],[60,7],[62,7],[61,7],[63,7],[64,7],[10,7],[65,7],[66,7],[67,7],[11,7],[75,7],[68,7],[69,7],[70,7],[71,7],[72,7],[1,7],[16,7],[15,7],[114,54],[124,55],[113,54],[134,56],[105,57],[104,58],[133,59],[127,60],[132,61],[107,62],[121,63],[106,64],[130,65],[102,66],[101,59],[131,67],[103,68],[108,69],[109,7],[112,69],[99,7],[135,70],[125,71],[116,72],[117,73],[119,74],[115,75],[118,76],[128,59],[110,77],[111,78],[120,79],[100,80],[123,71],[122,69],[126,7],[129,81],[80,82],[77,7],[79,83],[81,84],[86,85],[87,7],[82,86],[88,87],[83,88],[84,89],[78,7],[85,90]],"latestChangedDtsFile":"./workspace-sid.d.ts","version":"5.9.3"}

package/lib/acl.d.ts

@@ -0,0 +1,83 @@
+/**
+ * ACL editing helpers: grant/revoke a capability SID on a directory via
+ * SetEntriesInAclW + SetNamedSecurityInfoW (the same calls the POC uses, with
+ * the failure handling the POC lacks). Every API call is checked and every
+ * failure is reported with the API name, the exact Win32 code, the formatted
+ * system text, and the affected path.
+ *
+ * Concurrency: grants are read-merge-write against the directory's CURRENT
+ * DACL, and the whole get-merge-set sequence runs under a per-path exclusive
+ * LockFileEx lock (see {@link withPathLock}) so concurrent sandbox instances
+ * cannot clobber each other's ACEs.
+ * @module @bo-agent/sandbox-windows-acl/acl
+ */
+import type { NativePtr, Win32Bindings } from './ffi.ts';
+/**
+ * Pack one EXPLICIT_ACCESS_W (48 bytes, layout verified by abi-probe.cpp):
+ * perms@0, mode@4, inheritance@8, Trustee@16 { pMultipleTrustee@16,
+ * MultipleTrusteeOperation@24, TrusteeForm@28, TrusteeType@32, ptstrName@40 }.
+ * `permissions` is the access mask; the POC passes 0 for REVOKE_ACCESS, which
+ * removes every ACE for the trustee.
+ * @param sidPtr - the trustee SID the entry names.
+ * @param mode - the access mode (GRANT_ACCESS or REVOKE_ACCESS).
+ * @param permissions - the access mask to grant (0 for REVOKE_ACCESS).
+ * @returns the packed entry buffer.
+ */
+export declare function buildExplicitAccess(sidPtr: NativePtr, mode: number, permissions: number): Buffer;
+/**
+ * One lock file per protected path: `<GetTempPathW()>\dsh-acl-locks\<first 16
+ * hex of sha256(lowercased path)>.lock`. The lock root derives from
+ * GetTempPathW (never from runner argv or DSH_HOME), and the lowercasing
+ * maps Windows's case-insensitive path spellings onto one lock.
+ * @param api - the binding table.
+ * @param path - the protected directory (absolute).
+ * @returns the lock file path for that directory.
+ */
+export declare function lockFilePath(api: Win32Bindings, path: string): string;
+/**
+ * Run `action` holding the per-path exclusive lock: CreateFileW
+ * (OPEN_ALWAYS, shared read/write but NOT delete — a deletable lock file
+ * could be removed and recreated under the holder, letting two processes
+ * hold "the same" lock), then a one-byte LockFileEx
+ * (LOCKFILE_EXCLUSIVE_LOCK, zeroed OVERLAPPED = lock from offset 0 on the
+ * synchronous handle — see allocOverlapped for why not NULL), then
+ * UnlockFileEx + CloseHandle. Fail-closed: open/lock/unlock/close failures
+ * throw like every other Win32 call in this package; an `action` failure
+ * still unlocks (best-effort) and rethrows the original error.
+ * @param api - the binding table.
+ * @param path - the protected directory (absolute).
+ * @param action - the get-merge-set sequence to serialize.
+ * @returns the action's result.
+ */
+export declare function withPathLock<T>(api: Win32Bindings, path: string, action: () => T): T;
+/**
+ * Grant `GRANT_MASK` (Write+Delete, displays as "Modify") to the capability SID
+ * on `path`, inheriting to subcontainers and objects. Idempotent: when the
+ * directory's current explicit DACL already carries the exact ACE (the
+ * per-session grant surviving from a previous server lifetime), the
+ * SetNamedSecurityInfoW apply is SKIPPED — it would otherwise re-propagate
+ * the identical ACE across the whole tree (eager inheritance; minutes on
+ * large workspaces). Otherwise read-merge-write: the new ACE merges into the
+ * directory's CURRENT explicit DACL (same shape as {@link revokeWrite}), so
+ * pre-existing explicit ACEs survive. Runs under the per-path lock. The
+ * directory must be owned by the caller (owner implicit WRITE_DAC) — same
+ * precondition as the POC.
+ * @param api - the binding table.
+ * @param path - the directory whose DACL gains the grant (the workspace or temp root).
+ * @param sidPtr - the capability SID the ACE names.
+ */
+export declare function grantWrite(api: Win32Bindings, path: string, sidPtr: NativePtr): void;
+/**
+ * Remove every ACE for the capability SID from the directory DACL (REVOKE_ACCESS
+ * merge — other entries are preserved). Returns whether an ACE removal was
+ * attempted (false when the directory carries no DACL at all).
+ *
+ * Runs under the per-path lock (the whole get-merge-set sequence); the
+ * descriptor/ACL allocation contract lives on {@link readCurrentDacl}.
+ * @param api - the binding table.
+ * @param path - the directory whose DACL loses the capability-SID ACEs.
+ * @param sidPtr - the capability SID whose ACEs are removed.
+ * @returns whether an ACE removal was attempted (false when the directory carries no DACL at all).
+ */
+export declare function revokeWrite(api: Win32Bindings, path: string, sidPtr: NativePtr): boolean;
+//# sourceMappingURL=acl.d.ts.map

package/lib/acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGxD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAUhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAkCpF;AA0GD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAapF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAaxF"}

package/lib/acl.js

@@ -0,0 +1,255 @@
+/**
+ * ACL editing helpers: grant/revoke a capability SID on a directory via
+ * SetEntriesInAclW + SetNamedSecurityInfoW (the same calls the POC uses, with
+ * the failure handling the POC lacks). Every API call is checked and every
+ * failure is reported with the API name, the exact Win32 code, the formatted
+ * system text, and the affected path.
+ *
+ * Concurrency: grants are read-merge-write against the directory's CURRENT
+ * DACL, and the whole get-merge-set sequence runs under a per-path exclusive
+ * LockFileEx lock (see {@link withPathLock}) so concurrent sandbox instances
+ * cannot clobber each other's ACEs.
+ * @module @bo-agent/sandbox-windows-acl/acl
+ */
+import { createHash } from 'node:crypto';
+import { mkdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { allocOverlapped, allocPtrSlot, decodePtr, decodeUint8At, decodeUint16At, decodeUint32At, getTempPath, isInvalidHandle, isNullPtr, ptrAddress, sameSidAt, throwLastError, throwWin32 } from "./ffi.js";
+import * as abi from "./win32-abi.js";
+/**
+ * Pack one EXPLICIT_ACCESS_W (48 bytes, layout verified by abi-probe.cpp):
+ * perms@0, mode@4, inheritance@8, Trustee@16 { pMultipleTrustee@16,
+ * MultipleTrusteeOperation@24, TrusteeForm@28, TrusteeType@32, ptstrName@40 }.
+ * `permissions` is the access mask; the POC passes 0 for REVOKE_ACCESS, which
+ * removes every ACE for the trustee.
+ * @param sidPtr - the trustee SID the entry names.
+ * @param mode - the access mode (GRANT_ACCESS or REVOKE_ACCESS).
+ * @param permissions - the access mask to grant (0 for REVOKE_ACCESS).
+ * @returns the packed entry buffer.
+ */
+export function buildExplicitAccess(sidPtr, mode, permissions) {
+    const entry = Buffer.alloc(abi.EXPLICIT_ACCESS_W_SIZE);
+    entry.writeUInt32LE(permissions, 0); // grfAccessPermissions
+    entry.writeUInt32LE(mode, 4); // grfAccessMode
+    entry.writeUInt32LE(abi.SUB_CONTAINERS_AND_OBJECTS_INHERIT, 8); // grfInheritance: OI|CI
+    entry.writeUInt32LE(abi.NO_MULTIPLE_TRUSTEE, 24); // Trustee.MultipleTrusteeOperation
+    entry.writeUInt32LE(abi.TRUSTEE_IS_SID, 28); // Trustee.TrusteeForm
+    entry.writeUInt32LE(abi.TRUSTEE_IS_UNKNOWN, 32); // Trustee.TrusteeType
+    entry.writeBigUInt64LE(ptrAddress(sidPtr), 40); // Trustee.ptstrName = the capability SID
+    return entry;
+}
+/**
+ * One lock file per protected path: `<GetTempPathW()>\dsh-acl-locks\<first 16
+ * hex of sha256(lowercased path)>.lock`. The lock root derives from
+ * GetTempPathW (never from runner argv or DSH_HOME), and the lowercasing
+ * maps Windows's case-insensitive path spellings onto one lock.
+ * @param api - the binding table.
+ * @param path - the protected directory (absolute).
+ * @returns the lock file path for that directory.
+ */
+export function lockFilePath(api, path) {
+    const digest = createHash('sha256').update(path.toLowerCase()).digest('hex').slice(0, 16);
+    return join(getTempPath(api), 'dsh-acl-locks', `${digest}.lock`);
+}
+/**
+ * Run `action` holding the per-path exclusive lock: CreateFileW
+ * (OPEN_ALWAYS, shared read/write but NOT delete — a deletable lock file
+ * could be removed and recreated under the holder, letting two processes
+ * hold "the same" lock), then a one-byte LockFileEx
+ * (LOCKFILE_EXCLUSIVE_LOCK, zeroed OVERLAPPED = lock from offset 0 on the
+ * synchronous handle — see allocOverlapped for why not NULL), then
+ * UnlockFileEx + CloseHandle. Fail-closed: open/lock/unlock/close failures
+ * throw like every other Win32 call in this package; an `action` failure
+ * still unlocks (best-effort) and rethrows the original error.
+ * @param api - the binding table.
+ * @param path - the protected directory (absolute).
+ * @param action - the get-merge-set sequence to serialize.
+ * @returns the action's result.
+ */
+export function withPathLock(api, path, action) {
+    const lockPath = lockFilePath(api, path);
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const handle = api.createFileW(lockPath, abi.GENERIC_READ | abi.GENERIC_WRITE, abi.FILE_SHARE_READ | abi.FILE_SHARE_WRITE, null, abi.OPEN_ALWAYS, 0, null);
+    if (isInvalidHandle(handle))
+        throwLastError(api, 'CreateFileW', lockPath);
+    const overlapped = allocOverlapped(); // stays zeroed: offset 0, hEvent NULL
+    if (api.lockFileEx(handle, abi.LOCKFILE_EXCLUSIVE_LOCK, 0, 1, 0, overlapped) === 0) {
+        const win32Code = api.getLastError();
+        api.closeHandle(handle); // best-effort on the lock-failure path
+        throwWin32(api, 'LockFileEx', win32Code, lockPath);
+    }
+    let result;
+    try {
+        result = action();
+    }
+    catch (error) {
+        // Best-effort release on the action-failure path: cleanup failures must
+        // not mask the action's error.
+        api.unlockFileEx(handle, 0, 1, 0, overlapped);
+        api.closeHandle(handle);
+        throw error;
+    }
+    if (api.unlockFileEx(handle, 0, 1, 0, overlapped) === 0) {
+        const win32Code = api.getLastError();
+        api.closeHandle(handle); // best-effort on the unlock-failure path
+        throwWin32(api, 'UnlockFileEx', win32Code, lockPath);
+    }
+    if (api.closeHandle(handle) === 0)
+        throwLastError(api, 'CloseHandle', `lock file ${lockPath}`);
+    return result;
+}
+/**
+ * Read the directory's current explicit DACL via GetNamedSecurityInfoW.
+ * Allocation contract (the POC's RevokeAccess, minus its missing checks): the
+ * returned ACL pointer sits INSIDE the security descriptor allocation — only
+ * the descriptor may be LocalFree'd, and it must not be freed before
+ * SetEntriesInAclW has consumed the ACL. Freeing the ACL pointer itself
+ * corrupts the heap (verified the hard way).
+ * @param api - the binding table.
+ * @param path - the directory whose DACL is read.
+ * @returns the current explicit DACL (null when the directory carries none) and its owning descriptor.
+ */
+function readCurrentDacl(api, path) {
+    const ownerSlot = allocPtrSlot();
+    const groupSlot = allocPtrSlot();
+    const daclSlot = allocPtrSlot();
+    const saclSlot = allocPtrSlot();
+    const descriptorSlot = allocPtrSlot();
+    const readResult = api.getNamedSecurityInfoW(path, abi.SE_FILE_OBJECT, abi.DACL_SECURITY_INFORMATION, ownerSlot, groupSlot, daclSlot, saclSlot, descriptorSlot);
+    if (readResult !== abi.ERROR_SUCCESS)
+        throwWin32(api, 'GetNamedSecurityInfoW', readResult, path);
+    return { oldAcl: decodePtr(daclSlot), descriptor: decodePtr(descriptorSlot) };
+}
+/**
+ * Shared tail of grantWrite and revokeWrite: merge `entry` into `oldAcl`
+ * (null = no explicit DACL yet; SetEntriesInAclW builds one from scratch),
+ * free the descriptor before applying the merged ACL, apply it, then free the
+ * merged ACL — checking every call and reporting with the caller's label.
+ * @param api - the binding table.
+ * @param path - the directory the DACL edit applies to.
+ * @param entry - the EXPLICIT_ACCESS_W to merge (grant or revoke).
+ * @param oldAcl - the current explicit DACL (from {@link readCurrentDacl}).
+ * @param descriptor - the descriptor allocation owning `oldAcl`.
+ * @param label - the caller's name for error details.
+ */
+function mergeAndApply(api, path, entry, oldAcl, descriptor, label) {
+    const newAclSlot = allocPtrSlot();
+    const mergeResult = api.setEntriesInAclW(1, entry, oldAcl, newAclSlot);
+    if (mergeResult !== abi.ERROR_SUCCESS) {
+        if (descriptor !== null)
+            api.localFree(descriptor); // frees the ACL block too
+        throwWin32(api, 'SetEntriesInAclW', mergeResult, `${label}(${path})`);
+    }
+    const newAcl = decodePtr(newAclSlot);
+    if (newAcl === null) {
+        if (descriptor !== null)
+            api.localFree(descriptor);
+        throwWin32(api, 'SetEntriesInAclW', api.getLastError(), `${label}(${path}): null new ACL`);
+    }
+    // The descriptor block (oldAcl included) is dead after the merge — free it
+    // before applying, exactly like the POC.
+    const freedDescriptor = descriptor !== null ? api.localFree(descriptor) : null;
+    const applyResult = api.setNamedSecurityInfoW(path, abi.SE_FILE_OBJECT, abi.DACL_SECURITY_INFORMATION, null, null, newAcl, null);
+    const freedNew = api.localFree(newAcl);
+    if (applyResult !== abi.ERROR_SUCCESS)
+        throwWin32(api, 'SetNamedSecurityInfoW', applyResult, `${label}(${path})`);
+    if (freedDescriptor !== null && !isNullPtr(freedDescriptor))
+        throwLastError(api, 'LocalFree', `${label}(${path}) descriptor`);
+    if (!isNullPtr(freedNew))
+        throwLastError(api, 'LocalFree', `${label}(${path}) new ACL`);
+}
+/**
+ * True when the explicit DACL already carries the EXACT write grant this
+ * module would add (Allow ACE, OI|CI inheritance, {@link abi.GRANT_MASK}, the
+ * capability SID). Every field is read through koffi.decode at pointer offsets —
+ * no memcpy, no pointer arithmetic. The ACE's SID is INLINE (embedded in the
+ * ACE after the 4-byte mask — there is no pointer to read; reading one
+ * yields garbage addresses and crashed EqualSid, verified by gdb), so it is
+ * compared field-by-field against the capability SID through bounded offset
+ * reads ({@link sameSidAt}). A malformed header reads as "no exact grant"
+ * so the caller falls back to the merge-apply path, which owns the robust
+ * failure handling.
+ * @param oldAcl - the current explicit DACL pointer (from {@link readCurrentDacl}).
+ * @param sidPtr - the capability SID to match.
+ * @returns whether the exact grant ACE is already present.
+ */
+function hasExactGrant(oldAcl, sidPtr) {
+    const aclSize = decodeUint16At(oldAcl, 2);
+    const aceCount = decodeUint16At(oldAcl, 4);
+    if (aclSize < 8 || aclSize > 1_048_576)
+        return false; // implausible: fall back to the merge path
+    let offset = 8; // the first ACE follows the 8-byte ACL header
+    for (let index = 0; index < aceCount; index++) {
+        // ACE_HEADER: AceType@0, AceFlags@1, AceSize@2 (WORD);
+        // ACCESS_ALLOWED_ACE: Mask@4, inline SID@8.
+        const aceSize = decodeUint16At(oldAcl, offset + 2);
+        if (aceSize < 8 || offset + aceSize > aclSize)
+            return false; // implausible: fall back to the merge path
+        const exact = decodeUint8At(oldAcl, offset) === abi.ACCESS_ALLOWED_ACE_TYPE
+            && decodeUint8At(oldAcl, offset + 1) === abi.SUB_CONTAINERS_AND_OBJECTS_INHERIT
+            && decodeUint32At(oldAcl, offset + 4) === abi.GRANT_MASK;
+        if (exact && sameSidAt(oldAcl, offset + 8, sidPtr, 0))
+            return true;
+        offset += aceSize;
+    }
+    return false;
+}
+/**
+ * Grant `GRANT_MASK` (Write+Delete, displays as "Modify") to the capability SID
+ * on `path`, inheriting to subcontainers and objects. Idempotent: when the
+ * directory's current explicit DACL already carries the exact ACE (the
+ * per-session grant surviving from a previous server lifetime), the
+ * SetNamedSecurityInfoW apply is SKIPPED — it would otherwise re-propagate
+ * the identical ACE across the whole tree (eager inheritance; minutes on
+ * large workspaces). Otherwise read-merge-write: the new ACE merges into the
+ * directory's CURRENT explicit DACL (same shape as {@link revokeWrite}), so
+ * pre-existing explicit ACEs survive. Runs under the per-path lock. The
+ * directory must be owned by the caller (owner implicit WRITE_DAC) — same
+ * precondition as the POC.
+ * @param api - the binding table.
+ * @param path - the directory whose DACL gains the grant (the workspace or temp root).
+ * @param sidPtr - the capability SID the ACE names.
+ */
+export function grantWrite(api, path, sidPtr) {
+    withPathLock(api, path, () => {
+        const { oldAcl, descriptor } = readCurrentDacl(api, path);
+        if (oldAcl !== null && hasExactGrant(oldAcl, sidPtr)) {
+            // The exact ACE stands: releasing the descriptor is the whole operation.
+            if (descriptor !== null) {
+                const freed = api.localFree(descriptor);
+                if (!isNullPtr(freed))
+                    throwLastError(api, 'LocalFree', `grantWrite(${path}) descriptor`);
+            }
+            return;
+        }
+        mergeAndApply(api, path, buildExplicitAccess(sidPtr, abi.GRANT_ACCESS, abi.GRANT_MASK), oldAcl, descriptor, 'grantWrite');
+    });
+}
+/**
+ * Remove every ACE for the capability SID from the directory DACL (REVOKE_ACCESS
+ * merge — other entries are preserved). Returns whether an ACE removal was
+ * attempted (false when the directory carries no DACL at all).
+ *
+ * Runs under the per-path lock (the whole get-merge-set sequence); the
+ * descriptor/ACL allocation contract lives on {@link readCurrentDacl}.
+ * @param api - the binding table.
+ * @param path - the directory whose DACL loses the capability-SID ACEs.
+ * @param sidPtr - the capability SID whose ACEs are removed.
+ * @returns whether an ACE removal was attempted (false when the directory carries no DACL at all).
+ */
+export function revokeWrite(api, path, sidPtr) {
+    return withPathLock(api, path, () => {
+        const { oldAcl, descriptor } = readCurrentDacl(api, path);
+        if (oldAcl === null) {
+            if (descriptor !== null) {
+                const freed = api.localFree(descriptor);
+                if (!isNullPtr(freed))
+                    throwLastError(api, 'LocalFree', `revokeWrite(${path}) descriptor`);
+            }
+            return false;
+        }
+        mergeAndApply(api, path, buildExplicitAccess(sidPtr, abi.REVOKE_ACCESS, 0), oldAcl, descriptor, 'revokeWrite');
+        return true;
+    });
+}
+//# sourceMappingURL=acl.js.map

package/lib/acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.js","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAE9M,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAA;AAErC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAiB,EAAE,IAAY,EAAE,WAAmB;IACtF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IACtD,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA,CAAC,uBAAuB;IAC3D,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA,CAAC,gBAAgB;IAC7C,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,kCAAkC,EAAE,CAAC,CAAC,CAAA,CAAC,wBAAwB;IACvF,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA,CAAC,mCAAmC;IACpF,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA,CAAC,sBAAsB;IAClE,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA,CAAC,sBAAsB;IACtE,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,yCAAyC;IACxF,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB,EAAE,IAAY;IAC3D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzF,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,MAAM,OAAO,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAI,GAAkB,EAAE,IAAY,EAAE,MAAe;IAC/E,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACxC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAC5B,QAAQ,EACR,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,aAAa,EACpC,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,gBAAgB,EAC1C,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,CAC/B,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAA;IACzE,MAAM,UAAU,GAAG,eAAe,EAAE,CAAA,CAAC,sCAAsC;IAC3E,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,uBAAuB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA,CAAC,uCAAuC;QAC/D,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,MAAS,CAAA;IACb,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAA;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,+BAA+B;QAC/B,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAA;QAC7C,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;QACvB,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QACpC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA,CAAC,yCAAyC;QACjE,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,aAAa,QAAQ,EAAE,CAAC,CAAA;IAC9F,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,GAAkB,EAAE,IAAY;IACvD,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAA;IAC/B,MAAM,cAAc,GAAG,YAAY,EAAE,CAAA;IACrC,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,CAC1C,IAAI,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,yBAAyB,EACvD,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,CACzD,CAAA;IACD,IAAI,UAAU,KAAK,GAAG,CAAC,aAAa;QAAE,UAAU,CAAC,GAAG,EAAE,uBAAuB,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IAChG,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CACpB,GAAkB,EAClB,IAAY,EACZ,KAAa,EACb,MAAwB,EACxB,UAA4B,EAC5B,KAAa;IAEb,MAAM,UAAU,GAAG,YAAY,EAAE,CAAA;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACtE,IAAI,WAAW,KAAK,GAAG,CAAC,aAAa,EAAE,CAAC;QACtC,IAAI,UAAU,KAAK,IAAI;YAAE,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA,CAAC,0BAA0B;QAC7E,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,IAAI;YAAE,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QAClD,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,iBAAiB,CAAC,CAAA;IAC5F,CAAC;IAED,2EAA2E;IAC3E,yCAAyC;IACzC,MAAM,eAAe,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,qBAAqB,CAC3C,IAAI,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,yBAAyB,EACvD,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CACzB,CAAA;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,WAAW,KAAK,GAAG,CAAC,aAAa;QAAE,UAAU,CAAC,GAAG,EAAE,uBAAuB,EAAE,WAAW,EAAE,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,CAAA;IACjH,IAAI,eAAe,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,KAAK,IAAI,IAAI,cAAc,CAAC,CAAA;IAC7H,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,KAAK,IAAI,IAAI,WAAW,CAAC,CAAA;AACzF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,aAAa,CAAC,MAAiB,EAAE,MAAiB;IACzD,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IAC1C,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,SAAS;QAAE,OAAO,KAAK,CAAA,CAAC,2CAA2C;IAChG,IAAI,MAAM,GAAG,CAAC,CAAA,CAAC,8CAA8C;IAC7D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,uDAAuD;QACvD,4CAA4C;QAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,OAAO,GAAG,CAAC,IAAI,MAAM,GAAG,OAAO,GAAG,OAAO;YAAE,OAAO,KAAK,CAAA,CAAC,2CAA2C;QACvG,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,uBAAuB;eACtE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,kCAAkC;eAC5E,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,CAAA;QAC1D,IAAI,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;QAClE,MAAM,IAAI,OAAO,CAAA;IACnB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,UAAU,CAAC,GAAkB,EAAE,IAAY,EAAE,MAAiB;IAC5E,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACrD,yEAAyE;YACzE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;gBACvC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,cAAc,IAAI,cAAc,CAAC,CAAA;YAC3F,CAAC;YACD,OAAM;QACR,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IAC3H,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,GAAkB,EAAE,IAAY,EAAE,MAAiB;IAC7E,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;QAClC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;gBACvC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;oBAAE,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,IAAI,cAAc,CAAC,CAAA;YAC5F,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;QAC9G,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/errors.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Fail-closed Win32 error type. Every backend API failure raises this with the
+ * API name and the exact Win32 code; the original POC silently ignored every
+ * failed call and would run children UNRESTRICTED (fail-open) — that is the
+ * failure mode this class exists to prevent.
+ * @module @bo-agent/sandbox-windows-acl/errors
+ */
+export declare class Win32Error extends Error {
+    /** The failing Win32 API name, e.g. `CreateRestrictedToken`. */
+    readonly api: string;
+    /** The Win32 error code (`GetLastError` for BOOL APIs, the HRESULT-style return for ACL APIs). */
+    readonly win32Code: number;
+    constructor(api: string, win32Code: number, detail?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/lib/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,qBAAa,UAAW,SAAQ,KAAK;IACnC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;gBAEd,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAM5D"}

package/lib/errors.js

@@ -0,0 +1,20 @@
+/**
+ * Fail-closed Win32 error type. Every backend API failure raises this with the
+ * API name and the exact Win32 code; the original POC silently ignored every
+ * failed call and would run children UNRESTRICTED (fail-open) — that is the
+ * failure mode this class exists to prevent.
+ * @module @bo-agent/sandbox-windows-acl/errors
+ */
+export class Win32Error extends Error {
+    /** The failing Win32 API name, e.g. `CreateRestrictedToken`. */
+    api;
+    /** The Win32 error code (`GetLastError` for BOOL APIs, the HRESULT-style return for ACL APIs). */
+    win32Code;
+    constructor(api, win32Code, detail) {
+        super(`${api} failed (Win32 ${win32Code})${detail === undefined ? '' : `: ${detail}`}`);
+        this.name = 'Win32Error';
+        this.api = api;
+        this.win32Code = win32Code;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/lib/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,gEAAgE;IACvD,GAAG,CAAQ;IACpB,kGAAkG;IACzF,SAAS,CAAQ;IAE1B,YAAY,GAAW,EAAE,SAAiB,EAAE,MAAe;QACzD,KAAK,CAAC,GAAG,GAAG,kBAAkB,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF"}