@openclaw/fs-safe 0.1.1 → 0.2.0

package/dist/private-temp-workspace.js

@@ -3,6 +3,7 @@ import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileStore, fileStoreSync, } from "./file-store.js";
+import { openRootFileSync } from "./root-file.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 function sanitizeTempPrefix(prefix) {
     const sanitized = prefix.trim().replace(/[^a-zA-Z0-9._-]/g, "-");
@@ -12,21 +13,20 @@ function sanitizeTempPrefix(prefix) {
     return sanitized.endsWith("-") ? sanitized : `${sanitized}-`;
 }
 function resolveWorkspaceLeaf(dir, fileName) {
-    const raw = fileName.trim();
-    if (!raw ||
-        raw === "." ||
-        raw === ".." ||
-        raw.includes("\0") ||
-        raw.includes("/") ||
-        raw.includes("\\") ||
-        path.basename(raw) !== raw) {
-        throw new Error(`Invalid temp workspace file name: ${JSON.stringify(fileName)}`);
-    }
-    return path.join(dir, raw);
+    return path.join(dir, assertWorkspaceFileName(fileName));
 }
 function assertWorkspaceFileName(fileName) {
-    resolveWorkspaceLeaf(".", fileName);
-    return fileName.trim();
+    const value = fileName.trim();
+    if (!value ||
+        value === "." ||
+        value === ".." ||
+        value.includes("\0") ||
+        value.includes("/") ||
+        value.includes("\\") ||
+        path.basename(value) !== value) {
+        throw new Error(`Invalid temp workspace file name: ${JSON.stringify(fileName)}`);
+    }
+    return value;
 }
 async function ensurePrivateDirectory(dir, mode) {
     await fs.mkdir(dir, { recursive: true, mode });
@@ -144,8 +144,21 @@ export function tempWorkspaceSync(options) {
             trailingNewline: writeOptions?.trailingNewline,
         }),
         read: (fileName) => {
-            const filePath = store.path(assertWorkspaceFileName(fileName));
-            return fsSync.readFileSync(filePath);
+            const opened = openRootFileSync({
+                absolutePath: store.path(assertWorkspaceFileName(fileName)),
+                rootPath: dir,
+                boundaryLabel: "temp workspace",
+                rejectHardlinks: true,
+            });
+            if (!opened.ok) {
+                throw Object.assign(new Error(`File not found: ${fileName}`), { code: "ENOENT" });
+            }
+            try {
+                return fsSync.readFileSync(opened.fd);
+            }
+            finally {
+                fsSync.closeSync(opened.fd);
+            }
         },
         cleanup: () => {
             try {

package/dist/regular-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,MAAM,MAAM,SAAS,CAAC;AAO7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CAQR;AAWD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CA6B3C;AA0CD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CAoBA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CA2D7E"}
+{"version":3,"file":"regular-file.d.ts","sourceRoot":"","sources":["../src/regular-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,MAAM,MAAM,SAAS,CAAC;AAQ7B,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAExF,KAAK,8BAA8B,GAAG,IAAI,CACxC,OAAO,MAAM,CAAC,SAAS,EACvB,UAAU,GAAG,SAAS,GAAG,UAAU,CACpC,GACC,OAAO,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvD,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,SAAS,GAAE,8BAAiD,GAC3D,MAAM,CAQR;AA2DD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,CAc3E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAgC3C;AA6CD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC;CACb,CAoBA;AAmBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDxF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CA2D7E"}

package/dist/regular-file.js

@@ -17,6 +17,44 @@ function resolveRegularFileReadFlags() {
             ? fsSync.constants.O_NOFOLLOW
             : 0));
 }
+async function readFileHandleBounded(params) {
+    if (params.maxBytes === undefined) {
+        return await params.handle.readFile();
+    }
+    const chunks = [];
+    const scratch = Buffer.allocUnsafe(Math.min(64 * 1024, Math.max(1, params.maxBytes + 1)));
+    let total = 0;
+    while (true) {
+        const { bytesRead } = await params.handle.read(scratch, 0, scratch.length, null);
+        if (bytesRead === 0) {
+            return Buffer.concat(chunks, total);
+        }
+        total += bytesRead;
+        if (total > params.maxBytes) {
+            throw new Error(`File exceeds ${params.maxBytes} bytes: ${params.filePath}`);
+        }
+        chunks.push(Buffer.from(scratch.subarray(0, bytesRead)));
+    }
+}
+function readFileDescriptorBounded(params) {
+    if (params.maxBytes === undefined) {
+        return fsSync.readFileSync(params.fd);
+    }
+    const chunks = [];
+    const scratch = Buffer.allocUnsafe(Math.min(64 * 1024, Math.max(1, params.maxBytes + 1)));
+    let total = 0;
+    while (true) {
+        const bytesRead = fsSync.readSync(params.fd, scratch, 0, scratch.length, null);
+        if (bytesRead === 0) {
+            return Buffer.concat(chunks, total);
+        }
+        total += bytesRead;
+        if (total > params.maxBytes) {
+            throw new Error(`File exceeds ${params.maxBytes} bytes: ${params.filePath}`);
+        }
+        chunks.push(Buffer.from(scratch.subarray(0, bytesRead)));
+    }
+}
 export async function statRegularFile(filePath) {
     let stat;
     try {
@@ -69,10 +107,13 @@ export async function readRegularFile(params) {
         if (params.maxBytes !== undefined && stat.size > params.maxBytes) {
             throw new Error(`File exceeds ${params.maxBytes} bytes: ${params.filePath}`);
         }
-        const buffer = await handle.readFile();
-        if (params.maxBytes !== undefined && buffer.byteLength > params.maxBytes) {
-            throw new Error(`File exceeds ${params.maxBytes} bytes: ${params.filePath}`);
-        }
+        // With a byte cap, avoid readFile(): a raced file growth would allocate
+        // the oversized content before the post-read check could reject it.
+        const buffer = await readFileHandleBounded({
+            handle,
+            filePath: params.filePath,
+            maxBytes: params.maxBytes,
+        });
         return { buffer, stat };
     }
     finally {
@@ -99,10 +140,13 @@ function readOpenedRegularFileSync(params) {
     if (params.maxBytes !== undefined && stat.size > params.maxBytes) {
         throw new Error(`File exceeds ${params.maxBytes} bytes: ${params.filePath}`);
     }
-    const buffer = fsSync.readFileSync(params.fd);
-    if (params.maxBytes !== undefined && buffer.byteLength > params.maxBytes) {
-        throw new Error(`File exceeds ${params.maxBytes} bytes: ${params.filePath}`);
-    }
+    // Keep capped sync reads incremental for the same reason as async reads:
+    // readFileSync(fd) would buffer a raced oversized file before throwing.
+    const buffer = readFileDescriptorBounded({
+        fd: params.fd,
+        filePath: params.filePath,
+        maxBytes: params.maxBytes,
+    });
     return { buffer, stat };
 }
 export function readRegularFileSync(params) {

package/dist/replace-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-directory.d.ts","sourceRoot":"","sources":["../src/replace-directory.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAiCf"}
+{"version":3,"file":"replace-directory.d.ts","sourceRoot":"","sources":["../src/replace-directory.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAiCf"}

package/dist/replace-directory.js

@@ -1,5 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
+import { guardedRename, guardedRm } from "./guarded-mutation.js";
 export async function replaceDirectoryAtomic(options) {
     const targetDir = path.resolve(options.targetDir);
     const stagedDir = path.resolve(options.stagedDir);
@@ -8,7 +9,7 @@ export async function replaceDirectoryAtomic(options) {
     let backupCreated = false;
     await fs.mkdir(parentDir, { recursive: true });
     try {
-        await fs.rename(targetDir, backupDir);
+        await guardedRename({ from: targetDir, to: backupDir });
         backupCreated = true;
     }
     catch (err) {
@@ -17,16 +18,16 @@ export async function replaceDirectoryAtomic(options) {
         }
     }
     try {
-        await fs.rename(stagedDir, targetDir);
+        await guardedRename({ from: stagedDir, to: targetDir });
     }
     catch (err) {
         if (backupCreated) {
-            await fs.rename(backupDir, targetDir).catch(() => undefined);
+            await guardedRename({ from: backupDir, to: targetDir }).catch(() => undefined);
             backupCreated = false;
         }
         throw err;
     }
     if (backupCreated) {
-        await fs.rm(backupDir, { recursive: true, force: true });
+        await guardedRm({ target: backupDir, recursive: true, force: true, verifyAfter: false });
     }
 }

package/dist/replace-file.d.ts

@@ -3,7 +3,7 @@ import fs from "node:fs/promises";
 export type ReplaceFileAtomicFileSystem = {
     promises: Pick<typeof fs, "mkdir" | "chmod" | "writeFile" | "rename" | "copyFile" | "unlink" | "rm" | "open" | "stat" | "lstat">;
 };
-export type ReplaceFileAtomicSyncFileSystem = Pick<typeof syncFs, "mkdirSync" | "chmodSync" | "writeFileSync" | "renameSync" | "copyFileSync" | "unlinkSync" | "rmSync" | "openSync" | "fsyncSync" | "closeSync" | "statSync" | "lstatSync">;
+export type ReplaceFileAtomicSyncFileSystem = Pick<typeof syncFs, "mkdirSync" | "chmodSync" | "readFileSync" | "writeFileSync" | "renameSync" | "copyFileSync" | "unlinkSync" | "rmSync" | "openSync" | "fsyncSync" | "closeSync" | "statSync" | "lstatSync">;
 type ReplaceFileAtomicBaseOptions = {
     filePath: string;
     content: string | Uint8Array;

package/dist/replace-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replace-file.d.ts","sourceRoot":"","sources":["../src/replace-file.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAKlC,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,IAAI,CACZ,OAAO,EAAE,EACP,OAAO,GACP,OAAO,GACP,WAAW,GACX,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,MAAM,GACN,OAAO,CACV,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,OAAO,MAAM,EACX,WAAW,GACX,WAAW,GACX,eAAe,GACf,YAAY,GACZ,cAAc,GACd,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,WAAW,GACX,WAAW,GACX,UAAU,GACV,WAAW,CACd,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,4BAA4B,GAAG;IACpE,UAAU,CAAC,EAAE,2BAA2B,CAAC;IACzC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,GAAG;IACxE,UAAU,CAAC,EAAE,+BAA+B,CAAC;IAC7C,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAAC;CACpC,CAAC;AA+NF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAMlC;AAyDD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,uBAAuB,CAiEzB"}
+{"version":3,"file":"replace-file.d.ts","sourceRoot":"","sources":["../src/replace-file.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAMlC,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,EAAE,IAAI,CACZ,OAAO,EAAE,EACP,OAAO,GACP,OAAO,GACP,WAAW,GACX,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,MAAM,GACN,OAAO,CACV,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG,IAAI,CAChD,OAAO,MAAM,EACX,WAAW,GACX,WAAW,GACX,cAAc,GACd,eAAe,GACf,YAAY,GACZ,cAAc,GACd,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,WAAW,GACX,WAAW,GACX,UAAU,GACV,WAAW,CACd,CAAC;AAEF,KAAK,4BAA4B,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,4BAA4B,GAAG;IACpE,UAAU,CAAC,EAAE,2BAA2B,CAAC;IACzC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClF,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,GAAG;IACxE,UAAU,CAAC,EAAE,+BAA+B,CAAC;IAC7C,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACzE,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,QAAQ,GAAG,eAAe,CAAC;CACpC,CAAC;AAySF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CAMlC;AAyDD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,4BAA4B,GACpC,uBAAuB,CAiEzB"}

package/dist/replace-file.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import syncFs from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { assertSafePathPrefix } from "./safe-path-segment.js";
 import { registerTempPathForExit } from "./temp-cleanup.js";
 import { serializePathWrite } from "./write-queue.js";
 function isRetryableRenameError(error) {
@@ -11,6 +12,12 @@ function isPermissionRenameError(error) {
     const code = error.code;
     return code === "EPERM" || code === "EEXIST";
 }
+const SUPPORTS_NOFOLLOW = process.platform !== "win32" && "O_NOFOLLOW" in syncFs.constants;
+const OPEN_READ_FLAGS = syncFs.constants.O_RDONLY | (SUPPORTS_NOFOLLOW ? syncFs.constants.O_NOFOLLOW : 0);
+const OPEN_WRITE_EXCLUSIVE_FLAGS = syncFs.constants.O_WRONLY |
+    syncFs.constants.O_CREAT |
+    syncFs.constants.O_EXCL |
+    (SUPPORTS_NOFOLLOW ? syncFs.constants.O_NOFOLLOW : 0);
 async function sleep(ms) {
     await new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -26,17 +33,7 @@ async function renameWithRetry(params) {
                 continue;
             }
             if (params.copyFallbackOnPermissionError && isPermissionRenameError(error)) {
-                const stat = await params.fsModule.lstat(params.dest).catch((lstatError) => {
-                    if (lstatError.code === "ENOENT") {
-                        return null;
-                    }
-                    throw lstatError;
-                });
-                if (stat?.isSymbolicLink()) {
-                    throw new Error(`Refusing copy fallback through symlink destination: ${params.dest}`);
-                }
-                await params.fsModule.copyFile(params.src, params.dest);
-                await params.fsModule.unlink(params.src).catch(() => undefined);
+                await copyFallbackReplace(params.fsModule, params.src, params.dest);
                 return { method: "copy-fallback" };
             }
             throw error;
@@ -62,25 +59,7 @@ function renameWithRetrySync(params) {
                 continue;
             }
             if (params.copyFallbackOnPermissionError && isPermissionRenameError(error)) {
-                let stat = null;
-                try {
-                    stat = params.fsModule.lstatSync(params.dest);
-                }
-                catch (lstatError) {
-                    if (lstatError.code !== "ENOENT") {
-                        throw lstatError;
-                    }
-                }
-                if (stat?.isSymbolicLink()) {
-                    throw new Error(`Refusing copy fallback through symlink destination: ${params.dest}`);
-                }
-                params.fsModule.copyFileSync(params.src, params.dest);
-                try {
-                    params.fsModule.unlinkSync(params.src);
-                }
-                catch {
-                    // Best-effort cleanup after fallback replacement.
-                }
+                copyFallbackReplaceSync(params.fsModule, params.src, params.dest);
                 return { method: "copy-fallback" };
             }
             throw error;
@@ -88,6 +67,88 @@ function renameWithRetrySync(params) {
     }
     throw new Error("Atomic rename retry loop exhausted.");
 }
+async function copyFallbackReplace(fsModule, src, dest) {
+    const sourceStat = await fsModule.lstat(src);
+    if (sourceStat.isSymbolicLink() || !sourceStat.isFile()) {
+        throw new Error(`Refusing copy fallback from non-file source: ${src}`);
+    }
+    const destStat = await fsModule.lstat(dest).catch((lstatError) => {
+        if (lstatError.code === "ENOENT") {
+            return null;
+        }
+        throw lstatError;
+    });
+    if (destStat?.isSymbolicLink()) {
+        throw new Error(`Refusing copy fallback through symlink destination: ${dest}`);
+    }
+    if (destStat) {
+        await fsModule.rm(dest, { force: true });
+    }
+    let sourceHandle = null;
+    let destHandle = null;
+    try {
+        sourceHandle = await fsModule.open(src, OPEN_READ_FLAGS);
+        destHandle = await fsModule.open(dest, OPEN_WRITE_EXCLUSIVE_FLAGS, sourceStat.mode & 0o777);
+        await destHandle.writeFile(await sourceHandle.readFile());
+    }
+    finally {
+        await destHandle?.close().catch(() => undefined);
+        await sourceHandle?.close().catch(() => undefined);
+    }
+    await fsModule.unlink(src).catch(() => undefined);
+}
+function copyFallbackReplaceSync(fsModule, src, dest) {
+    const sourceStat = fsModule.lstatSync(src);
+    if (sourceStat.isSymbolicLink() || !sourceStat.isFile()) {
+        throw new Error(`Refusing copy fallback from non-file source: ${src}`);
+    }
+    let destStat = null;
+    try {
+        destStat = fsModule.lstatSync(dest);
+    }
+    catch (lstatError) {
+        if (lstatError.code !== "ENOENT") {
+            throw lstatError;
+        }
+    }
+    if (destStat?.isSymbolicLink()) {
+        throw new Error(`Refusing copy fallback through symlink destination: ${dest}`);
+    }
+    if (destStat) {
+        fsModule.rmSync(dest, { force: true });
+    }
+    let sourceFd;
+    let destFd;
+    try {
+        sourceFd = fsModule.openSync(src, OPEN_READ_FLAGS);
+        destFd = fsModule.openSync(dest, OPEN_WRITE_EXCLUSIVE_FLAGS, sourceStat.mode & 0o777);
+        fsModule.writeFileSync(destFd, fsModule.readFileSync(sourceFd));
+    }
+    finally {
+        if (destFd !== undefined) {
+            try {
+                fsModule.closeSync(destFd);
+            }
+            catch {
+                // Best-effort close after fallback replacement.
+            }
+        }
+        if (sourceFd !== undefined) {
+            try {
+                fsModule.closeSync(sourceFd);
+            }
+            catch {
+                // Best-effort close after fallback replacement.
+            }
+        }
+    }
+    try {
+        fsModule.unlinkSync(src);
+    }
+    catch {
+        // Best-effort cleanup after fallback replacement.
+    }
+}
 function validateReplaceFilePath(filePath) {
     if (!filePath || filePath.includes("\0")) {
         throw new Error("Atomic replace file path must be non-empty.");
@@ -95,7 +156,8 @@ function validateReplaceFilePath(filePath) {
 }
 function buildReplaceTempPath(filePath, tempPrefix) {
     const dir = path.dirname(filePath);
-    return path.join(dir, `${tempPrefix ?? ".fs-safe-replace"}.${process.pid}.${randomUUID()}.tmp`);
+    const safePrefix = assertSafePathPrefix(tempPrefix ?? ".fs-safe-replace", { label: "atomic replace temp prefix" });
+    return path.join(dir, `${safePrefix}.${process.pid}.${randomUUID()}.tmp`);
 }
 async function resolveMode(options) {
     const defaultMode = options.mode ?? 0o600;

package/dist/root-context.d.ts

@@ -0,0 +1,23 @@
+export type RootContext = {
+    rootDir: string;
+    rootReal: string;
+    rootWithSep: string;
+};
+export declare const ensureTrailingSep: (value: string) => string;
+export declare function assertValidRootRelativePath(relativePath: string): void;
+export declare function expandRelativePathWithHome(relativePath: string): Promise<string>;
+export declare function resolveRootContext(rootDir: string): Promise<RootContext>;
+export declare function resolvePathInRoot(root: RootContext, relativePath: string): Promise<{
+    rootReal: string;
+    rootWithSep: string;
+    resolved: string;
+}>;
+export declare function resolvePathWithinRoot(params: {
+    rootDir: string;
+    relativePath: string;
+}): Promise<{
+    rootReal: string;
+    rootWithSep: string;
+    resolved: string;
+}>;
+//# sourceMappingURL=root-context.d.ts.map

package/dist/root-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-context.d.ts","sourceRoot":"","sources":["../src/root-context.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,WACM,CAAC;AAEtD,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAEtE;AAID,wBAAsB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYtF;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAuB9E;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAQtE;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAEvE"}

package/dist/root-context.js

@@ -0,0 +1,62 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { expandHomePrefix } from "./home-dir.js";
+import { assertNoNulPathInput, isNotFoundPathError, isPathInside } from "./path.js";
+export const ensureTrailingSep = (value) => value.endsWith(path.sep) ? value : value + path.sep;
+export function assertValidRootRelativePath(relativePath) {
+    assertNoNulPathInput(relativePath, "relative path contains a NUL byte");
+}
+let cachedHomePath;
+export async function expandRelativePathWithHome(relativePath) {
+    const rawHome = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    if (cachedHomePath?.raw !== rawHome) {
+        let realHome = rawHome;
+        try {
+            realHome = await fs.realpath(rawHome);
+        }
+        catch {
+            // If the home dir cannot be canonicalized, keep lexical expansion behavior.
+        }
+        cachedHomePath = { raw: rawHome, real: realHome };
+    }
+    return expandHomePrefix(relativePath, { home: cachedHomePath.real });
+}
+export async function resolveRootContext(rootDir) {
+    assertNoNulPathInput(rootDir, "root dir contains a NUL byte");
+    let rootReal;
+    try {
+        rootReal = await fs.realpath(rootDir);
+        const rootStat = await fs.stat(rootReal);
+        if (!rootStat.isDirectory()) {
+            throw new FsSafeError("invalid-path", "root dir is not a directory");
+        }
+    }
+    catch (err) {
+        if (err instanceof FsSafeError) {
+            throw err;
+        }
+        if (isNotFoundPathError(err)) {
+            throw new FsSafeError("not-found", "root dir not found");
+        }
+        throw err;
+    }
+    return {
+        rootDir: path.resolve(rootDir),
+        rootReal,
+        rootWithSep: ensureTrailingSep(rootReal),
+    };
+}
+export async function resolvePathInRoot(root, relativePath) {
+    assertValidRootRelativePath(relativePath);
+    const expanded = await expandRelativePathWithHome(relativePath);
+    const resolved = path.resolve(root.rootWithSep, expanded);
+    if (!isPathInside(root.rootWithSep, resolved)) {
+        throw new FsSafeError("outside-workspace", "file is outside workspace root");
+    }
+    return { rootReal: root.rootReal, rootWithSep: root.rootWithSep, resolved };
+}
+export async function resolvePathWithinRoot(params) {
+    return await resolvePathInRoot(await resolveRootContext(params.rootDir), params.relativePath);
+}

package/dist/root-errors.d.ts

@@ -0,0 +1,4 @@
+export declare function isAlreadyExistsError(error: unknown): boolean;
+export declare function normalizePinnedWriteError(error: unknown): Error;
+export declare function normalizePinnedPathError(error: unknown): Error;
+//# sourceMappingURL=root-errors.d.ts.map

package/dist/root-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-errors.d.ts","sourceRoot":"","sources":["../src/root-errors.ts"],"names":[],"mappings":"AAGA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5D;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAO/D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAO9D"}

package/dist/root-errors.js

@@ -0,0 +1,21 @@
+import { FsSafeError } from "./errors.js";
+import { hasNodeErrorCode } from "./path.js";
+export function isAlreadyExistsError(error) {
+    return hasNodeErrorCode(error, "EEXIST") || /File exists|EEXIST/i.test(String(error));
+}
+export function normalizePinnedWriteError(error) {
+    if (error instanceof FsSafeError) {
+        return error;
+    }
+    return new FsSafeError("invalid-path", "path is not a regular file under root", {
+        cause: error instanceof Error ? error : undefined,
+    });
+}
+export function normalizePinnedPathError(error) {
+    if (error instanceof FsSafeError) {
+        return error;
+    }
+    return new FsSafeError("path-alias", "path is not under root", {
+        cause: error instanceof Error ? error : undefined,
+    });
+}

package/dist/root-impl.d.ts

@@ -0,0 +1,108 @@
+import type { Stats } from "node:fs";
+import type { FileHandle } from "node:fs/promises";
+import type { DirEntry, PathStat } from "./types.js";
+export type OpenResult = {
+    handle: FileHandle;
+    realPath: string;
+    stat: Stats;
+    [Symbol.asyncDispose](): Promise<void>;
+};
+export type ReadResult = {
+    buffer: Buffer;
+    realPath: string;
+    stat: Stats;
+};
+export type RootOptions = {
+    rootDir: string;
+    defaults?: RootDefaults;
+};
+export type SymlinkPolicy = "reject" | "follow-within-root";
+export type HardlinkPolicy = "reject" | "allow";
+export type WritableOpenMode = "replace" | "append" | "update";
+export type RootDefaults = {
+    hardlinks?: HardlinkPolicy;
+    maxBytes?: number;
+    mkdir?: boolean;
+    mode?: number;
+    nonBlockingRead?: boolean;
+    symlinks?: SymlinkPolicy;
+};
+export type RootReadOptions = Pick<RootDefaults, "hardlinks" | "maxBytes" | "nonBlockingRead" | "symlinks">;
+export type RootOpenOptions = Omit<RootReadOptions, "maxBytes">;
+export type RootWriteOptions = Pick<RootDefaults, "mkdir" | "mode"> & {
+    encoding?: BufferEncoding;
+    overwrite?: boolean;
+};
+export type RootOpenWritableOptions = Pick<RootDefaults, "mkdir" | "mode"> & {
+    writeMode?: WritableOpenMode;
+};
+export type RootCopyOptions = Pick<RootDefaults, "maxBytes" | "mkdir" | "mode"> & {
+    sourceHardlinks?: HardlinkPolicy;
+};
+export type RootWriteJsonOptions = RootWriteOptions & {
+    replacer?: Parameters<typeof JSON.stringify>[1];
+    space?: Parameters<typeof JSON.stringify>[2];
+    trailingNewline?: boolean;
+};
+export type RootCreateOptions = Omit<RootWriteOptions, "overwrite">;
+export type RootCreateJsonOptions = Omit<RootWriteJsonOptions, "overwrite">;
+export type RootAppendOptions = RootWriteOptions & {
+    prependNewlineIfNeeded?: boolean;
+};
+export declare const DEFAULT_ROOT_MAX_BYTES: number;
+export interface Root {
+    readonly rootDir: string;
+    readonly rootReal: string;
+    readonly rootWithSep: string;
+    readonly defaults: RootDefaults;
+    resolve(relativePath: string): Promise<string>;
+    open(relativePath: string, options?: RootOpenOptions): Promise<OpenResult>;
+    read(relativePath: string, options?: RootReadOptions): Promise<ReadResult>;
+    readBytes(relativePath: string, options?: RootReadOptions): Promise<Buffer>;
+    readText(relativePath: string, options?: RootReadOptions & {
+        encoding?: BufferEncoding;
+    }): Promise<string>;
+    readJson<T = unknown>(relativePath: string, options?: RootReadOptions & {
+        encoding?: BufferEncoding;
+    }): Promise<T>;
+    readAbsolute(filePath: string, options?: RootReadOptions): Promise<ReadResult>;
+    reader(options?: RootReadOptions): (filePath: string) => Promise<Buffer>;
+    openWritable(relativePath: string, options?: RootOpenWritableOptions): Promise<WritableOpenResult>;
+    append(relativePath: string, data: string | Buffer, options?: RootAppendOptions): Promise<void>;
+    remove(relativePath: string): Promise<void>;
+    mkdir(relativePath: string): Promise<void>;
+    ensureRoot(): Promise<void>;
+    write(relativePath: string, data: string | Buffer, options?: RootWriteOptions): Promise<void>;
+    create(relativePath: string, data: string | Buffer, options?: RootCreateOptions): Promise<void>;
+    writeJson(relativePath: string, data: unknown, options?: RootWriteJsonOptions): Promise<void>;
+    createJson(relativePath: string, data: unknown, options?: RootCreateJsonOptions): Promise<void>;
+    copyIn(relativePath: string, sourcePath: string, options?: RootCopyOptions): Promise<void>;
+    exists(relativePath: string): Promise<boolean>;
+    stat(relativePath: string): Promise<PathStat>;
+    list(relativePath: string, options?: {
+        withFileTypes?: false;
+    }): Promise<string[]>;
+    list(relativePath: string, options: {
+        withFileTypes: true;
+    }): Promise<DirEntry[]>;
+    move(fromRelative: string, toRelative: string, options?: {
+        overwrite?: boolean;
+    }): Promise<void>;
+}
+export declare function root(rootDir: string, defaults?: RootDefaults): Promise<Root>;
+export declare function readLocalFileSafely(params: {
+    filePath: string;
+    maxBytes?: number;
+}): Promise<ReadResult>;
+export declare function openLocalFileSafely(params: {
+    filePath: string;
+}): Promise<OpenResult>;
+export type WritableOpenResult = {
+    handle: FileHandle;
+    createdForWrite: boolean;
+    realPath: string;
+    stat: Stats;
+    [Symbol.asyncDispose](): Promise<void>;
+};
+export declare function resolveOpenedFileRealPathForHandle(handle: FileHandle, ioPath: string): Promise<string>;
+//# sourceMappingURL=root-impl.d.ts.map

package/dist/root-impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-impl.d.ts","sourceRoot":"","sources":["../src/root-impl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AA0CnD,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAIrD,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;IACZ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,oBAAoB,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,YAAY,EACZ,WAAW,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAC1D,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC,GAAG;IACpE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,MAAM,CAAC,GAAG;IAC3E,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC,GAAG;IAChF,eAAe,CAAC,EAAE,cAAc,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG;IACpD,QAAQ,CAAC,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,GAAG;IACjD,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC,CAAC;AAgCF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AA0HvD,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAEhC,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5E,QAAQ,CACN,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,CAAC,EAAE,cAAc,CAAA;KAAE,GACxD,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAClB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,eAAe,GAAG;QAAE,QAAQ,CAAC,EAAE,cAAc,CAAA;KAAE,GACxD,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,YAAY,CACV,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,MAAM,CACJ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,KAAK,CACH,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CACJ,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CACR,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,aAAa,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClF,IAAI,CACF,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AA6QD,wBAAsB,IAAI,CACxB,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,YAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAEf;AAiFD,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,UAAU,CAAC,CAOtB;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAG3F;AA0BD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,CAAC;IACZ,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC,CAAC;AAqDF,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAoCjB"}