@openclaw/fs-safe 0.11.0 → 0.13.0

package/dist/secure-temp-dir.js

@@ -1,8 +1,11 @@
 import fs from "node:fs";
 import { tmpdir as getOsTmpDir } from "node:os";
 import path from "node:path";
+import { directoryEntryPath } from "./directory-entry-path.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
 import { assertSafePathSegment } from "./safe-path-segment.js";
+import { assertNoWindowsPathAlias, pathForWindowsFilesystem } from "./windows-path-alias.js";
+import { captureSecureTempRepairAdapter, repairSecureTempDirectory, secureTempDirectoryReceipt, } from "./secure-temp-repair.js";
 function isNodeErrorWithCode(err, code) {
     return (typeof err === "object" &&
         err !== null &&
@@ -10,152 +13,169 @@ function isNodeErrorWithCode(err, code) {
         err.code === code);
 }
 export function resolveSecureTempRoot(options) {
-    const fallbackPrefix = assertSafePathSegment(options.fallbackPrefix, {
+    const { fallbackPrefix: prefix, accessSync: suppliedAccess, lstatSync: suppliedLstat, mkdirSync: suppliedMkdir, descriptor: suppliedDescriptor, getuid: suppliedGetuid, tmpdir: suppliedTmpdir, platform: suppliedPlatform, preferredDir, skipPreferredOnWindows, warn: suppliedWarn, warningPrefix: suppliedWarningPrefix, unsafeFallbackLabel: suppliedFallbackLabel, } = options;
+    const platform = suppliedPlatform ?? process.platform;
+    const windows = process.platform === "win32" || platform === "win32";
+    // A platform adapter cannot disable the host's Windows pathname policy.
+    const admissionPlatform = process.platform === "win32" ? process.platform : platform;
+    const capturedDescriptor = captureSecureTempRepairAdapter(suppliedDescriptor, suppliedAccess !== undefined || suppliedLstat !== undefined || suppliedMkdir !== undefined);
+    const descriptor = windows ? undefined : capturedDescriptor;
+    const hostLstat = fs.lstatSync;
+    const hostAccess = fs.accessSync;
+    const hostMkdir = fs.mkdirSync;
+    const hostGetuid = process.getuid;
+    const accessSync = suppliedAccess ?? (process.platform === "win32"
+        ? (candidate, mode) => hostAccess(pathForWindowsFilesystem(candidate), mode)
+        : hostAccess);
+    const lstatSync = descriptor
+        ? (candidate) => descriptor.lstatSync(candidate, { bigint: true })
+        : suppliedLstat ?? ((candidate) => windows
+            ? hostLstat(pathForWindowsFilesystem(candidate))
+            : hostLstat(candidate, { bigint: true }));
+    // Virtual observations cannot authorize host creation. A supplied mkdir hook
+    // is explicit authority; chmodSync is deprecated and deliberately not read.
+    const mkdirSync = suppliedMkdir ?? (suppliedLstat !== undefined || suppliedAccess !== undefined || suppliedDescriptor !== undefined
+        ? undefined
+        : (directory, mkdirOptions) => hostMkdir(recursiveMkdirPath(pathForWindowsFilesystem(directory)), mkdirOptions));
+    const warn = suppliedWarn ?? console.warn.bind(console);
+    const warningPrefix = suppliedWarningPrefix ?? "[fs-safe]";
+    const unsafeFallbackLabel = suppliedFallbackLabel ?? "secure temp dir";
+    const tmpdir = typeof suppliedTmpdir === "function" ? suppliedTmpdir : getOsTmpDir;
+    const getuid = suppliedGetuid ?? (() => {
+        try {
+            return typeof hostGetuid === "function" ? hostGetuid.call(process) : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    });
+    const fallbackPrefix = assertSafePathSegment(prefix, {
         allowDotPrefix: true,
         label: "fallback temp prefix",
     });
     const TMP_DIR_ACCESS_MODE = fs.constants.W_OK | fs.constants.X_OK;
-    const accessSync = options.accessSync ?? fs.accessSync;
-    const chmodSync = options.chmodSync ?? fs.chmodSync;
-    const lstatSync = options.lstatSync ?? fs.lstatSync;
-    const mkdirSync = options.mkdirSync ?? ((directory, mkdirOptions) => fs.mkdirSync(recursiveMkdirPath(directory), mkdirOptions));
-    const warn = options.warn ?? ((message) => console.warn(message));
-    const warningPrefix = options.warningPrefix ?? "[fs-safe]";
-    const unsafeFallbackLabel = options.unsafeFallbackLabel ?? "secure temp dir";
-    const getuid = options.getuid ??
-        (() => {
-            try {
-                return typeof process.getuid === "function" ? process.getuid() : undefined;
-            }
-            catch {
-                return undefined;
-            }
-        });
-    const tmpdir = typeof options.tmpdir === "function" ? options.tmpdir : getOsTmpDir;
-    const platform = options.platform ?? process.platform;
     const uid = getuid();
+    if (uid !== undefined && (!Number.isSafeInteger(uid) || uid < 0)) {
+        throw new Error("Secure temp directory user identity is invalid.");
+    }
+    if (preferredDir !== undefined) {
+        assertNoWindowsPathAlias(preferredDir, "filesystem", "preferred temp directory uses a Windows filesystem namespace alias", admissionPlatform);
+    }
     const isSecureDirForUser = (st) => {
-        if (uid === undefined) {
+        if (windows || uid === undefined)
             return true;
-        }
-        if (typeof st.uid === "number" && st.uid !== uid) {
+        const { uid: owner, mode } = st;
+        if (owner !== undefined && owner !== uid && owner !== BigInt(uid))
             return false;
-        }
-        if (typeof st.mode === "number" && (st.mode & 0o022) !== 0) {
-            return false;
-        }
-        return true;
+        if (typeof mode === "bigint")
+            return mode >= 0n && (mode & 18n) === 0n;
+        return mode === undefined || (Number.isSafeInteger(mode) && mode >= 0 && (mode & 0o022) === 0);
     };
     const fallback = () => {
         const base = tmpdir();
+        assertNoWindowsPathAlias(base, "filesystem", "system temp directory uses a Windows filesystem namespace alias", admissionPlatform);
         const suffix = uid === undefined ? fallbackPrefix : `${fallbackPrefix}-${uid}`;
         const joiner = platform === "win32" ? path.win32.join : path.join;
-        return joiner(base, suffix);
-    };
-    const isTrustedTmpDir = (st) => {
-        return st.isDirectory() && !st.isSymbolicLink() && isSecureDirForUser(st);
+        const fallbackPath = joiner(base, suffix);
+        assertNoWindowsPathAlias(fallbackPath, "filesystem", "fallback temp directory uses a Windows filesystem namespace alias", admissionPlatform);
+        return fallbackPath;
     };
     const resolveDirState = (candidatePath) => {
+        assertNoWindowsPathAlias(candidatePath, "filesystem", "temp directory uses a Windows filesystem namespace alias", admissionPlatform);
+        let candidate;
         try {
-            const candidate = lstatSync(candidatePath);
-            if (!isTrustedTmpDir(candidate)) {
-                return "invalid";
+            candidate = lstatSync(candidatePath);
+        }
+        catch (error) {
+            return { kind: isNodeErrorWithCode(error, "ENOENT") ? "missing" : "invalid", error };
+        }
+        let receipt;
+        try {
+            if (descriptor && uid !== undefined) {
+                receipt = secureTempDirectoryReceipt(candidate, uid);
+            }
+            if (receipt ? (receipt.mode & 18n) !== 0n :
+                candidate.isDirectory() !== true || candidate.isSymbolicLink() !== false || !isSecureDirForUser(candidate)) {
+                return { kind: "invalid", receipt };
             }
             accessSync(candidatePath, TMP_DIR_ACCESS_MODE);
-            return "available";
+            return { kind: "available", receipt };
         }
-        catch (err) {
-            if (isNodeErrorWithCode(err, "ENOENT")) {
-                return "missing";
-            }
-            return "invalid";
+        catch (error) {
+            return { kind: "invalid", receipt, error };
         }
     };
-    const tryRepairWritableBits = (candidatePath) => {
+    const tryRepair = (candidatePath, state, finalize = false) => {
+        assertNoWindowsPathAlias(candidatePath, "filesystem", "temp directory uses a Windows filesystem namespace alias", admissionPlatform);
+        if (!descriptor || uid === undefined || !state.receipt) {
+            return finalize ? { kind: "invalid", error: new Error("Secure temp descriptor finalization is unavailable.") } : state;
+        }
         try {
-            const st = lstatSync(candidatePath);
-            if (!st.isDirectory() || st.isSymbolicLink()) {
-                return false;
-            }
-            if (uid !== undefined && typeof st.uid === "number" && st.uid !== uid) {
-                return false;
-            }
-            if (typeof st.mode !== "number") {
-                return false;
-            }
-            if ((st.mode & 0o022) === 0) {
-                return resolveDirState(candidatePath) === "available";
-            }
-            try {
-                chmodSync(candidatePath, 0o700);
-            }
-            catch (chmodErr) {
-                if (isNodeErrorWithCode(chmodErr, "EPERM") ||
-                    isNodeErrorWithCode(chmodErr, "EACCES") ||
-                    isNodeErrorWithCode(chmodErr, "ENOENT")) {
-                    return resolveDirState(candidatePath) === "available";
-                }
-                throw chmodErr;
-            }
-            warn(`${warningPrefix} tightened permissions on temp dir: ${candidatePath}`);
-            return resolveDirState(candidatePath) === "available";
+            repairSecureTempDirectory(candidatePath, state.receipt, uid, descriptor, () => accessSync(candidatePath, TMP_DIR_ACCESS_MODE), () => warn(`${warningPrefix} tightened permissions on temp dir: ${candidatePath}`), finalize);
+            return { kind: "available" };
         }
-        catch {
-            return false;
+        catch (error) {
+            return { kind: "invalid", error };
         }
     };
     const ensureTrustedFallbackDir = () => {
         const fallbackPath = fallback();
-        const state = resolveDirState(fallbackPath);
-        if (state === "available") {
+        const entryPath = directoryEntryPath(fallbackPath, windows ? "win32" : platform);
+        let state = resolveDirState(entryPath);
+        let finalize = false;
+        if (state.kind === "available")
             return fallbackPath;
-        }
-        if (state === "invalid") {
-            if (tryRepairWritableBits(fallbackPath)) {
-                return fallbackPath;
+        if (state.kind === "missing") {
+            try {
+                if (!mkdirSync)
+                    throw new Error("Secure temp creation requires an explicit filesystem adapter.");
+                const created = mkdirSync(entryPath, { recursive: true, mode: 0o700 });
+                finalize = !windows && (suppliedMkdir !== undefined || created !== undefined);
             }
-            throw new Error(`Unsafe fallback ${unsafeFallbackLabel}: ${fallbackPath}`);
-        }
-        try {
-            mkdirSync(fallbackPath, { recursive: true, mode: 0o700 });
-            chmodSync(fallbackPath, 0o700);
-        }
-        catch {
-            throw new Error(`Unable to create fallback ${unsafeFallbackLabel}: ${fallbackPath}`);
+            catch (cause) {
+                throw new Error(`Unable to create fallback ${unsafeFallbackLabel}: ${fallbackPath}`, { cause });
+            }
+            // A concurrent mkdir winner has no implicit ownership or mode authority.
+            state = resolveDirState(entryPath);
+            if (state.kind === "available" && !finalize)
+                return fallbackPath;
         }
-        if (resolveDirState(fallbackPath) !== "available" && !tryRepairWritableBits(fallbackPath)) {
-            throw new Error(`Unsafe fallback ${unsafeFallbackLabel}: ${fallbackPath}`);
+        state = tryRepair(entryPath, state, finalize);
+        if (state.kind !== "available") {
+            throw new Error(`Unsafe fallback ${unsafeFallbackLabel}: ${fallbackPath}`, { cause: state.error });
         }
         return fallbackPath;
     };
-    if (options.skipPreferredOnWindows === true && platform === "win32") {
+    if (skipPreferredOnWindows === true && platform === "win32") {
         return ensureTrustedFallbackDir();
     }
-    if (!options.preferredDir) {
+    if (!preferredDir) {
         return ensureTrustedFallbackDir();
     }
-    const existingPreferredState = resolveDirState(options.preferredDir);
-    if (existingPreferredState === "available") {
-        return options.preferredDir;
+    const entryPath = directoryEntryPath(preferredDir, windows ? "win32" : platform);
+    const existingPreferredState = resolveDirState(entryPath);
+    if (existingPreferredState.kind === "available") {
+        return preferredDir;
     }
-    if (existingPreferredState === "invalid") {
-        if (tryRepairWritableBits(options.preferredDir)) {
-            return options.preferredDir;
+    if (existingPreferredState.kind === "invalid") {
+        if (tryRepair(entryPath, existingPreferredState).kind === "available") {
+            return preferredDir;
         }
         return ensureTrustedFallbackDir();
     }
+    let preferredAvailable = false;
     try {
-        const preferredParentDir = path.dirname(options.preferredDir);
+        const preferredParentDir = (windows ? path.win32 : path).dirname(entryPath);
         accessSync(preferredParentDir, TMP_DIR_ACCESS_MODE);
-        mkdirSync(options.preferredDir, { recursive: true, mode: 0o700 });
-        chmodSync(options.preferredDir, 0o700);
-        if (resolveDirState(options.preferredDir) !== "available" &&
-            !tryRepairWritableBits(options.preferredDir)) {
-            return ensureTrustedFallbackDir();
+        if (mkdirSync) {
+            const created = mkdirSync(entryPath, { recursive: true, mode: 0o700 });
+            const finalize = !windows && (suppliedMkdir !== undefined || created !== undefined);
+            const state = resolveDirState(entryPath);
+            preferredAvailable = (!finalize && state.kind === "available") || tryRepair(entryPath, state, finalize).kind === "available";
         }
-        return options.preferredDir;
     }
     catch {
-        return ensureTrustedFallbackDir();
+        // A failed preferred path never relaxes fallback admission.
     }
+    return preferredAvailable ? preferredDir : ensureTrustedFallbackDir();
 }

package/dist/secure-temp-repair.d.ts

@@ -0,0 +1,35 @@
+import { type BigIntStats } from "node:fs";
+type ExactDirectoryStat = Pick<BigIntStats, "dev" | "ino" | "uid" | "mode" | "isDirectory" | "isSymbolicLink">;
+/** Complete, synchronous descriptor authority for secure-temp admission and repair. */
+export type SecureTempRootDescriptorAdapter = {
+    lstatSync(path: string, options: {
+        bigint: true;
+    }): ExactDirectoryStat;
+    fstatSync(fd: number, options: {
+        bigint: true;
+    }): ExactDirectoryStat;
+    openSync(path: string, flags: number): number;
+    fchmodSync(fd: number, mode: number): void;
+    closeSync(fd: number): void;
+    constants: {
+        O_RDONLY: number;
+        O_DIRECTORY: number;
+        O_NOFOLLOW: number;
+        O_NONBLOCK: number;
+    };
+};
+export type SecureTempDirectoryReceipt = Readonly<{
+    dev: bigint;
+    ino: bigint;
+    uid: bigint;
+    mode: bigint;
+}>;
+export type SecureTempRepairAdapter = Omit<SecureTempRootDescriptorAdapter, "constants"> & {
+    flags: number;
+};
+export declare function captureSecureTempRepairAdapter(supplied: SecureTempRootDescriptorAdapter | undefined, hasLegacyFsHooks: boolean): SecureTempRepairAdapter | undefined;
+export declare function secureTempDirectoryReceipt(stat: ExactDirectoryStat, uid: number): SecureTempDirectoryReceipt;
+/** No pathname chmod, search-only descriptors, procfs, or reopening fallback. */
+export declare function repairSecureTempDirectory(candidate: string, expected: SecureTempDirectoryReceipt, uid: number, adapter: SecureTempRepairAdapter, access: () => void, repaired: () => void, finalize?: boolean): void;
+export {};
+//# sourceMappingURL=secure-temp-repair.d.ts.map

package/dist/secure-temp-repair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-temp-repair.d.ts","sourceRoot":"","sources":["../src/secure-temp-repair.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/C,KAAK,kBAAkB,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,aAAa,GAAG,gBAAgB,CAAC,CAAC;AAE/G,uFAAuF;AACvF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,IAAI,CAAA;KAAE,GAAG,kBAAkB,CAAC;IACvE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,IAAI,CAAA;KAAE,GAAG,kBAAkB,CAAC;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9C,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9F,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC3G,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,+BAA+B,EAAE,WAAW,CAAC,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7G,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,+BAA+B,GAAG,SAAS,EACrD,gBAAgB,EAAE,OAAO,GACxB,uBAAuB,GAAG,SAAS,CAarC;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,0BAA0B,CAS5G;AAgBD,iFAAiF;AACjF,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,0BAA0B,EACpC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,MAAM,IAAI,EAClB,QAAQ,EAAE,MAAM,IAAI,EACpB,QAAQ,UAAQ,GACf,IAAI,CAuDN"}

package/dist/secure-temp-repair.js

@@ -0,0 +1,106 @@
+import fs, {} from "node:fs";
+export function captureSecureTempRepairAdapter(supplied, hasLegacyFsHooks) {
+    if (supplied === undefined && hasLegacyFsHooks)
+        return undefined;
+    if (supplied !== undefined && (supplied === null || (typeof supplied !== "object" && typeof supplied !== "function")))
+        return undefined;
+    const source = supplied === undefined ? fs : supplied;
+    const { lstatSync, fstatSync, openSync, fchmodSync, closeSync, constants } = source;
+    const { O_RDONLY, O_DIRECTORY, O_NOFOLLOW, O_NONBLOCK } = constants ?? {};
+    if ([lstatSync, fstatSync, openSync, fchmodSync, closeSync].some((fn) => typeof fn !== "function") ||
+        O_RDONLY !== 0 || [O_DIRECTORY, O_NOFOLLOW, O_NONBLOCK].some((flag) => !Number.isSafeInteger(flag) || flag <= 0 || flag > 0x7fff_ffff) ||
+        (O_DIRECTORY & O_NOFOLLOW) !== 0 || (O_DIRECTORY & O_NONBLOCK) !== 0 || (O_NOFOLLOW & O_NONBLOCK) !== 0) {
+        return undefined;
+    }
+    return { lstatSync, fstatSync, openSync, fchmodSync, closeSync, flags: O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_NONBLOCK };
+}
+export function secureTempDirectoryReceipt(stat, uid) {
+    const { dev, ino, uid: owner, mode } = stat;
+    if (typeof dev !== "bigint" || dev < 0n || typeof ino !== "bigint" || ino <= 0n ||
+        typeof owner !== "bigint" || owner !== BigInt(uid) || typeof mode !== "bigint" ||
+        mode < 0n || mode > 0xffffffffn || (mode & 61440n) !== 16384n ||
+        stat.isDirectory() !== true || stat.isSymbolicLink() !== false) {
+        throw new Error("Secure temp directory identity, owner, or type could not be verified.");
+    }
+    return { dev, ino, uid: owner, mode };
+}
+function assertSameDirectory(stat, expected, uid) {
+    const observed = secureTempDirectoryReceipt(stat, uid);
+    if (observed.dev !== expected.dev || observed.ino !== expected.ino || observed.uid !== expected.uid) {
+        throw new Error("Secure temp directory changed during repair.");
+    }
+    return observed;
+}
+function mayHaveConcurrentRepair(error) {
+    if (typeof error !== "object" || error === null || !("code" in error))
+        return false;
+    const code = error.code;
+    return code === "EPERM" || code === "EACCES" || code === "ENOENT";
+}
+/** No pathname chmod, search-only descriptors, procfs, or reopening fallback. */
+export function repairSecureTempDirectory(candidate, expected, uid, adapter, access, repaired, finalize = false) {
+    assertSameDirectory(adapter.lstatSync(candidate, { bigint: true }), expected, uid);
+    const fd = adapter.openSync(candidate, adapter.flags);
+    if (!Number.isSafeInteger(fd) || fd < 0)
+        throw new Error("Secure temp directory descriptor is invalid.");
+    const errors = [];
+    try {
+        const inspect = () => {
+            const opened = assertSameDirectory(adapter.fstatSync(fd, { bigint: true }), expected, uid);
+            const named = assertSameDirectory(adapter.lstatSync(candidate, { bigint: true }), expected, uid);
+            return { opened, named };
+        };
+        const verify = (requireExactMode) => {
+            const check = () => {
+                const { opened, named } = inspect();
+                for (const stat of [opened, named]) {
+                    if ((stat.mode & 18n) !== 0n || (requireExactMode && (stat.mode & 4095n) !== 448n)) {
+                        throw new Error("Secure temp directory permissions remain unsafe.");
+                    }
+                }
+            };
+            check();
+            access();
+            check();
+        };
+        const { opened } = inspect();
+        const needsChmod = finalize ? (opened.mode & 4095n) !== 448n :
+            (opened.mode & 18n) !== 0n || (opened.mode & 448n) !== 448n;
+        let chmodError;
+        let chmodFailed = false;
+        if (needsChmod) {
+            try {
+                adapter.fchmodSync(fd, 0o700);
+            }
+            catch (error) {
+                if (!mayHaveConcurrentRepair(error))
+                    throw error;
+                chmodFailed = true;
+                chmodError = error;
+            }
+            if (!chmodFailed)
+                repaired();
+        }
+        try {
+            verify(finalize || (needsChmod && !chmodFailed));
+        }
+        catch (error) {
+            if (chmodFailed)
+                throw new AggregateError([chmodError, error], "Secure temp directory chmod and verification failed.");
+            throw error;
+        }
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    try {
+        adapter.closeSync(fd);
+    }
+    catch (error) {
+        errors.push(error);
+    }
+    if (errors.length > 1)
+        throw new AggregateError(errors, "Secure temp directory repair and close failed.");
+    if (errors.length === 1)
+        throw errors[0];
+}

package/dist/sibling-staged-file.d.ts

@@ -1,5 +1,7 @@
+export declare function resolveCallbackTempPath(workspaceDir: string, component: string): string;
 export declare function writeCallbackSibling<T>(params: {
-    tempPath: string;
+    tempDir: string;
+    tempName: string;
     write: (tempPath: string) => Promise<T>;
     producerIsolation?: "private-directory";
     resolveFinalPath: (result: T) => string;

package/dist/sibling-staged-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sibling-staged-file.d.ts","sourceRoot":"","sources":["../src/sibling-staged-file.ts"],"names":[],"mappings":"AAuEA,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC,CA+G3C"}
+{"version":3,"file":"sibling-staged-file.d.ts","sourceRoot":"","sources":["../src/sibling-staged-file.ts"],"names":[],"mappings":"AAsCA,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAoBvF;AAsHD,wBAAsB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC,CAsK3C"}