@openclaw/fs-safe 0.12.0 → 0.13.0

package/dist/path-scope-lexical.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { isPathInside, isPathRelativeEscape } from "./path.js";
+import { hasWindowsPathAlias, resolvePathFromBasePreservingWindowsRoot } from "./windows-path-alias.js";
 function pathStaysWithinRoot(rootDir, candidatePath) {
     if (process.platform !== "win32") {
         return candidatePath !== rootDir && isPathInside(rootDir, candidatePath);
@@ -8,20 +9,29 @@ function pathStaysWithinRoot(rootDir, candidatePath) {
     return Boolean(relative) && !isPathRelativeEscape(relative);
 }
 export function resolvePathWithinNormalizedRoot(params, root) {
-    const raw = params.requestedPath.trim();
+    const requestedPath = params.requestedPath;
+    const defaultFileName = params.defaultFileName;
+    const scopeLabel = params.scopeLabel;
+    if (hasWindowsPathAlias(params.rootDir, "filesystem") ||
+        hasWindowsPathAlias(root, "filesystem") ||
+        hasWindowsPathAlias(requestedPath, "filesystem") ||
+        (defaultFileName !== undefined && hasWindowsPathAlias(defaultFileName, "filesystem"))) {
+        return { ok: false, error: `Invalid path: must stay within ${scopeLabel}` };
+    }
+    const raw = requestedPath.trim();
     if (!raw) {
-        if (!params.defaultFileName) {
+        if (!defaultFileName) {
             return { ok: false, error: "path is required" };
         }
-        const defaultPath = path.resolve(root, params.defaultFileName);
-        if (!pathStaysWithinRoot(root, defaultPath)) {
-            return { ok: false, error: `Invalid path: must stay within ${params.scopeLabel}` };
+        const defaultPath = resolvePathFromBasePreservingWindowsRoot(root, defaultFileName);
+        if (hasWindowsPathAlias(defaultPath, "filesystem") || !pathStaysWithinRoot(root, defaultPath)) {
+            return { ok: false, error: `Invalid path: must stay within ${scopeLabel}` };
         }
         return { ok: true, path: defaultPath };
     }
-    const resolved = path.resolve(root, raw);
-    if (!pathStaysWithinRoot(root, resolved)) {
-        return { ok: false, error: `Invalid path: must stay within ${params.scopeLabel}` };
+    const resolved = resolvePathFromBasePreservingWindowsRoot(root, raw);
+    if (hasWindowsPathAlias(resolved, "filesystem") || !pathStaysWithinRoot(root, resolved)) {
+        return { ok: false, error: `Invalid path: must stay within ${scopeLabel}` };
     }
     return { ok: true, path: resolved };
 }

package/dist/path-segment-route.d.ts

@@ -0,0 +1,7 @@
+export type PathSegmentRoute = Readonly<{
+    joined: string;
+    offsets: readonly number[];
+}>;
+export declare function createPathSegmentRoute(segments: readonly string[]): PathSegmentRoute;
+export declare function joinPathSegmentRoute(base: string, route: PathSegmentRoute, offset: number, tail?: string): string;
+//# sourceMappingURL=path-segment-route.d.ts.map

package/dist/path-segment-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-segment-route.d.ts","sourceRoot":"","sources":["../src/path-segment-route.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAUpF;AAID,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAMR"}

package/dist/path-segment-route.js

@@ -0,0 +1,24 @@
+import path from "node:path";
+export function createPathSegmentRoute(segments) {
+    const offsets = new Array(segments.length + 1);
+    let cursor = 0;
+    for (let index = 0; index < segments.length; index += 1) {
+        offsets[index] = cursor;
+        cursor += segments[index].length;
+        if (index + 1 < segments.length)
+            cursor += path.sep.length;
+    }
+    offsets[segments.length] = cursor;
+    return Object.freeze({ joined: segments.join(path.sep), offsets: Object.freeze(offsets) });
+}
+// Select the immutable suffix by character offset so callers perform at most
+// one path normalization without copying a shrinking segment array.
+export function joinPathSegmentRoute(base, route, offset, tail) {
+    const start = route.offsets[offset];
+    if (start === undefined)
+        throw new RangeError("path segment offset is outside the route");
+    const suffix = route.joined.slice(start);
+    if (suffix)
+        return tail === undefined ? path.join(base, suffix) : path.join(base, suffix, tail);
+    return tail === undefined ? base : path.join(base, tail);
+}

package/dist/path-suffix-aliases.d.ts

@@ -0,0 +1,10 @@
+export type ProbePathSuffixAliasesOptions = {
+    directory: string;
+    left: string;
+    right: string;
+    /** Synchronous caller policy for differing NFC pairs not equivalent under ASCII case folding. */
+    shouldProbeCaseVariants?: (leftNfc: string, rightNfc: string) => boolean;
+};
+/** Observe bounded missing suffix aliases; the caller owns caching and ambiguity policy. */
+export declare function probePathSuffixAliasesSync(options: ProbePathSuffixAliasesOptions): boolean | undefined;
+//# sourceMappingURL=path-suffix-aliases.d.ts.map

package/dist/path-suffix-aliases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-suffix-aliases.d.ts","sourceRoot":"","sources":["../src/path-suffix-aliases.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,6BAA6B,GAAG;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;CAC1E,CAAC;AA6UF,4FAA4F;AAC5F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,GAAG,SAAS,CA8CtG"}

package/dist/path-suffix-aliases.js

@@ -0,0 +1,386 @@
+import { randomInt } from "node:crypto";
+import fs, {} from "node:fs";
+import path from "node:path";
+import { assertDirectoryIdentitySync, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { isWindowsReservedDeviceName } from "./device-path.js";
+import { FsSafeError } from "./errors.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { hasNodeErrorCode } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+const MAX_SUFFIX_LENGTH = 8_192;
+const MAX_PATH_LENGTH = 32_768;
+const MAX_SUFFIX_DEPTH = 32;
+const MAX_MKDIR_ATTEMPTS = 128;
+const MAX_CREATED_DIRECTORIES = 64;
+const MAX_FORWARD_OBSERVATIONS = 4_096;
+const PROBE_NAME_LENGTH = 6;
+const PROBE_ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+const PROBE_FIRST_ALPHABET = "bdefghijkmoqrstuvwxyz";
+function unavailable() {
+    throw new Error("path suffix probe resources or cleanup authority are unavailable");
+}
+function assertMutationPath(value) {
+    if (value.length > MAX_PATH_LENGTH)
+        unavailable();
+}
+function suffixSegments(value) {
+    if (typeof value !== "string")
+        throw new TypeError("suffix must be a string");
+    if (value.length > MAX_SUFFIX_LENGTH)
+        throw new RangeError("suffix exceeds 8192 code units");
+    if (value.includes("\0") || path.isAbsolute(value)) {
+        throw new TypeError("suffix must be a relative path without NUL bytes");
+    }
+    const windows = process.platform === "win32";
+    const segments = (windows ? value.replaceAll("/", "\\") : value).split(path.sep);
+    if (segments.length > MAX_SUFFIX_DEPTH)
+        throw new RangeError("suffix exceeds 32 components");
+    if (segments.some(segment => !segment || segment === "." || segment === ".." ||
+        (windows && (segment.includes(":") || /^[ .]+$/u.test(segment) ||
+            isWindowsReservedDeviceName(segment))))) {
+        throw new TypeError("suffix must contain ordinary relative path components");
+    }
+    return segments;
+}
+function areAsciiCaseVariants(left, right) {
+    const fold = (value) => value.replace(/[A-Z]/gu, letter => String.fromCharCode(letter.charCodeAt(0) + 0x20));
+    return fold(left) === fold(right);
+}
+function forbiddenNames(leftNfc, rightNfc) {
+    const lower = new Set([leftNfc.toLowerCase(), rightNfc.toLowerCase()]);
+    const upper = new Set([leftNfc.toUpperCase(), rightNfc.toUpperCase()]);
+    // These conservative exclusions never classify filesystem aliases.
+    return candidate => {
+        const normalized = candidate.normalize("NFC");
+        return lower.has(normalized.toLowerCase()) || upper.has(normalized.toUpperCase());
+    };
+}
+function* normalizationProbePairs(left, right, forbidden, availableNameLength) {
+    const seen = new Set();
+    const replaceAscii = (value, replacements) => value.replace(/[A-Za-z]/gu, character => {
+        const lower = character.toLowerCase();
+        const replacement = replacements.get(lower);
+        return replacement ? character === lower ? replacement : replacement.toUpperCase() : character;
+    });
+    const presentAscii = [...new Set(`${left}${right}`.toLowerCase().match(/[a-z]/gu) ?? [])];
+    const mutableAscii = presentAscii.filter(source => {
+        const replacements = new Map([[source, source === "z" ? "y" : "z"]]);
+        return areAsciiCaseVariants(replaceAscii(left, replacements).normalize("NFC"), replaceAscii(right, replacements).normalize("NFC"));
+    });
+    for (let attempt = 0; attempt < 24 && mutableAscii.length > 0; attempt++) {
+        const replacements = new Map(mutableAscii.map(source => [
+            source, String.fromCharCode("a".charCodeAt(0) + randomInt(26)),
+        ]));
+        const first = replaceAscii(left, replacements);
+        const second = replaceAscii(right, replacements);
+        if (first.length > availableNameLength || second.length > availableNameLength ||
+            !areAsciiCaseVariants(first.normalize("NFC"), second.normalize("NFC")) ||
+            isWindowsReservedDeviceName(first) || isWindowsReservedDeviceName(second) ||
+            forbidden(first) || forbidden(second))
+            continue;
+        const key = `${first}\0${second}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            yield [first, second];
+        }
+    }
+}
+function createPrivateProbeName(nameLength) {
+    let name = "";
+    for (let index = 0; index < nameLength; index++) {
+        const alphabet = index === 0 ? PROBE_FIRST_ALPHABET : PROBE_ALPHABET;
+        name += alphabet[randomInt(alphabet.length)];
+    }
+    return name;
+}
+function* asciiCaseProbePairs(nameLength, forbidden) {
+    let count = 0;
+    for (let attempt = 0; attempt < 96 && count < 24; attempt++) {
+        const first = createPrivateProbeName(nameLength);
+        const second = `${first[0].toUpperCase()}${first.slice(1)}`;
+        if (!forbidden(first) && !forbidden(second)) {
+            count++;
+            yield [first, second];
+        }
+    }
+}
+function* privateProbeNames(nameLength, forbidden) {
+    let count = 0;
+    for (let attempt = 0; attempt < 96 && count < 24; attempt++) {
+        const name = createPrivateProbeName(nameLength);
+        if (!forbidden(name)) {
+            count++;
+            yield name;
+        }
+    }
+}
+function* prependPair(first, remaining) {
+    yield first;
+    yield* remaining;
+}
+class ProbeDirectories {
+    requestedDirectory;
+    root;
+    created = [];
+    cleanupComplete = true;
+    observations = 0;
+    mkdirAttempts = 0;
+    creations = 0;
+    constructor(requestedDirectory) {
+        this.requestedDirectory = requestedDirectory;
+        this.observe(1);
+        const canonical = realpathSync.native(pathForWindowsFilesystem(requestedDirectory));
+        assertMutationPath(canonical);
+        this.observe(2);
+        this.root = { path: canonical, identity: inspectDirectoryIdentitySync(canonical) };
+        this.assert(this.root);
+    }
+    reserveObservations(units) {
+        if (this.observations + units > MAX_FORWARD_OBSERVATIONS)
+            unavailable();
+    }
+    observe(units, cleanup = false) {
+        if (cleanup)
+            return;
+        this.reserveObservations(units);
+        this.observations += units;
+    }
+    assert(directory, cleanup = false) {
+        this.observe(1, cleanup);
+        if (realpathSync.native(pathForWindowsFilesystem(this.requestedDirectory)) !== this.root.path) {
+            throw new FsSafeError("path-mismatch", "probe directory changed");
+        }
+        for (let current = directory; current; current = current.parent) {
+            // Each strict identity helper can perform two observations on Windows.
+            this.observe(2, cleanup);
+            assertDirectoryIdentitySync(current.path, current.identity);
+        }
+    }
+    create(parent, name) {
+        if (this.mkdirAttempts >= MAX_MKDIR_ATTEMPTS || this.creations >= MAX_CREATED_DIRECTORIES)
+            unavailable();
+        const probePath = path.join(parent.path, name);
+        assertMutationPath(probePath);
+        this.assert(parent);
+        // Exhaustion must not itself create an entry whose first identity cannot be read.
+        this.reserveObservations(2);
+        this.mkdirAttempts++;
+        try {
+            fs.mkdirSync(probePath);
+        }
+        catch (error) {
+            if (hasNodeErrorCode(error, "EEXIST"))
+                return undefined;
+            throw error;
+        }
+        this.creations++;
+        this.observe(2);
+        // A failed initial observation can still leave an entry: mkdir returns no descriptor.
+        const created = { path: probePath, identity: inspectDirectoryIdentitySync(probePath), parent };
+        this.created.push(created);
+        this.assert(created);
+        return created;
+    }
+    remove(created, cleanup = false) {
+        try {
+            this.assert(created, cleanup);
+            assertMutationPath(created.path);
+            // Never recurse: unexpected children and replacements must remain.
+            fs.rmdirSync(created.path);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    probe(parent, pairs) {
+        for (const [first, alternate] of pairs) {
+            const alternatePath = path.join(parent.path, alternate);
+            assertMutationPath(alternatePath);
+            const created = this.create(parent, first);
+            if (!created)
+                continue;
+            let alias;
+            this.observe(2);
+            try {
+                alias = inspectFileIdentitySync(() => fs.lstatSync(alternatePath, { bigint: true }));
+            }
+            catch (error) {
+                if (!hasNodeErrorCode(error, "ENOENT"))
+                    throw error;
+            }
+            this.assert(created);
+            if (!alias)
+                return { aliases: false, directory: created };
+            if (alias.isDirectory() && !alias.isSymbolicLink() && sameFileIdentityForCleanup(created.identity, alias)) {
+                return { aliases: true, directory: created };
+            }
+            // A different alternate entry is a collision. Lost cleanup authority ends probing.
+            if (!this.remove(created)) {
+                this.cleanupComplete = false;
+                unavailable();
+            }
+            this.created.splice(this.created.indexOf(created), 1);
+        }
+        return undefined;
+    }
+    neutral(parent, nameLength, forbidden) {
+        for (const name of privateProbeNames(nameLength, forbidden)) {
+            const created = this.create(parent, name);
+            if (created)
+                return created;
+        }
+        return undefined;
+    }
+    cleanup() {
+        // Cleanup bypasses the forward budget; creation and depth caps bound its work.
+        for (let index = this.created.length - 1; index >= 0; index--) {
+            if (!this.remove(this.created[index], true))
+                this.cleanupComplete = false;
+        }
+        try {
+            this.assert(this.root, true);
+        }
+        catch {
+            this.cleanupComplete = false;
+        }
+        return this.cleanupComplete;
+    }
+}
+function observeSuffixes(getOwner, leftSegments, rightSegments, shouldProbeCaseVariants) {
+    let maxProbePathLength;
+    let probeParent;
+    for (let index = 0; index < leftSegments.length; index++) {
+        const left = leftSegments[index];
+        const right = rightSegments[index];
+        const normalizedLeft = left.normalize("NFC");
+        const normalizedRight = right.normalize("NFC");
+        const asciiCaseVariants = areAsciiCaseVariants(normalizedLeft, normalizedRight);
+        if (normalizedLeft !== normalizedRight && !asciiCaseVariants &&
+            !shouldProbeCaseVariants(normalizedLeft, normalizedRight))
+            return false;
+        const needsNormalization = left !== normalizedLeft || right !== normalizedRight;
+        if (normalizedLeft === normalizedRight && !needsNormalization && index === leftSegments.length - 1)
+            continue;
+        const owner = getOwner();
+        probeParent ??= owner.root;
+        maxProbePathLength ??= Math.max(path.join(owner.root.path, leftSegments.join(path.sep)).length, path.join(owner.root.path, rightSegments.join(path.sep)).length);
+        const availableNameLength = maxProbePathLength - probeParent.path.length -
+            (probeParent.path.endsWith(path.sep) ? 0 : 1);
+        const nameLength = Math.max(1, Math.min(PROBE_NAME_LENGTH, left.length, right.length));
+        const forbidden = forbiddenNames(normalizedLeft, normalizedRight);
+        let next;
+        if (normalizedLeft !== normalizedRight) {
+            let caseParent = probeParent;
+            let pairs;
+            if (asciiCaseVariants) {
+                pairs = asciiCaseProbePairs(nameLength, forbidden);
+            }
+            else {
+                const neutral = owner.neutral(probeParent, nameLength, forbidden);
+                if (!neutral)
+                    return undefined;
+                caseParent = neutral;
+                pairs = [[left, right]];
+            }
+            const observed = owner.probe(caseParent, pairs);
+            if (!observed)
+                return undefined;
+            if (!observed.aliases)
+                return false;
+            next = observed.directory;
+        }
+        if (needsNormalization) {
+            const generated = normalizationProbePairs(left, right, forbidden, availableNameLength);
+            const first = generated.next();
+            let pairs;
+            let normalizationParent = probeParent;
+            // Fallback only when no generated pair exists, not when generated names collide.
+            if (first.done) {
+                const neutral = owner.neutral(probeParent, nameLength, forbidden);
+                if (!neutral)
+                    return undefined;
+                normalizationParent = neutral;
+                pairs = [[left, right]];
+            }
+            else {
+                pairs = prependPair(first.value, generated);
+            }
+            const observed = owner.probe(normalizationParent, pairs);
+            if (!observed)
+                return undefined;
+            if (!observed.aliases)
+                return false;
+            next ??= observed.directory;
+        }
+        if (index < leftSegments.length - 1) {
+            next ??= owner.neutral(probeParent, nameLength, forbidden);
+            if (!next)
+                return undefined;
+            probeParent = next;
+        }
+    }
+    return true;
+}
+/** Observe bounded missing suffix aliases; the caller owns caching and ambiguity policy. */
+export function probePathSuffixAliasesSync(options) {
+    const requestedDirectory = options.directory;
+    if (typeof requestedDirectory !== "string")
+        throw new TypeError("directory must be a string");
+    if (requestedDirectory.length > MAX_PATH_LENGTH)
+        throw new RangeError("directory exceeds 32768 code units");
+    if (requestedDirectory.includes("\0"))
+        throw new TypeError("directory must be a path without NUL bytes");
+    // Preserve one-argument Windows drive-relative resolution before reentrant option getters.
+    const directory = resolvePathPreservingWindowsRoot(requestedDirectory);
+    if (directory.length > MAX_PATH_LENGTH)
+        throw new RangeError("resolved directory exceeds 32768 code units");
+    const leftInput = options.left;
+    const rightInput = options.right;
+    const predicate = options.shouldProbeCaseVariants;
+    const left = suffixSegments(leftInput);
+    const right = suffixSegments(rightInput);
+    if (left.length !== right.length)
+        throw new TypeError("suffixes must have the same component count");
+    if (predicate !== undefined && typeof predicate !== "function") {
+        throw new TypeError("shouldProbeCaseVariants must be a function");
+    }
+    if (leftInput === rightInput)
+        return true;
+    let callbackFailure;
+    const shouldProbe = (first, second) => {
+        if (!predicate)
+            return true;
+        try {
+            const result = predicate(first, second);
+            if (typeof result !== "boolean") {
+                void Promise.resolve(result).catch(() => undefined);
+                throw new TypeError("shouldProbeCaseVariants must return a boolean synchronously");
+            }
+            return result;
+        }
+        catch (error) {
+            callbackFailure = { error };
+            throw error;
+        }
+    };
+    let owner;
+    let observed;
+    let cleaned = true;
+    try {
+        observed = observeSuffixes(() => owner ??= new ProbeDirectories(directory), left, right, shouldProbe);
+        owner?.assert(owner.root);
+    }
+    catch {
+        observed = undefined;
+        if (callbackFailure)
+            throw callbackFailure.error;
+    }
+    finally {
+        if (owner)
+            cleaned = owner.cleanup();
+    }
+    return cleaned ? observed : undefined;
+}

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAWD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA0ClE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAUT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrF"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAczB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAaD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA0ClE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAsBT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAWrF"}

package/dist/path.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { FsSafeError } from "./errors.js";
 import { realpathSync } from "./realpath.js";
 import { isDriveRelativePath } from "./safe-path-segment.js";
+import { assertNoWindowsPathAlias, hasWindowsPathAlias, pathForWindowsFilesystem, resolvePathFromBasePreservingWindowsRoot, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, } from "./device-path.js";
 const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
 const SYMLINK_OPEN_CODES = new Set(["ELOOP", "EINVAL", "ENOTSUP"]);
@@ -25,7 +26,7 @@ function resolveWindowsPathForComparison(input) {
     // retain Node's additional normalization rules before comparison.
     return resolved[1] === ":" && path.win32.isAbsolute(resolved)
         ? resolved.toLowerCase()
-        : normalizeWindowsPathForComparison(resolved);
+        : normalizeWindowsPathForComparison(resolved.length === 6 ? resolvePathPreservingWindowsRoot(input) : resolved);
 }
 export function isNodeError(value) {
     return Boolean(value && typeof value === "object" && "code" in value);
@@ -95,7 +96,7 @@ export function safeRealpathSync(targetPath, cache) {
         return cached;
     }
     try {
-        const resolved = realpathSync(targetPath);
+        const resolved = realpathSync(pathForWindowsFilesystem(targetPath));
         cache?.set(targetPath, resolved);
         cache?.set(resolved, resolved);
         return resolved;
@@ -105,11 +106,19 @@ export function safeRealpathSync(targetPath, cache) {
     }
 }
 export function isPathInsideWithRealpath(basePath, candidatePath, opts) {
+    if (hasWindowsPathAlias(basePath, "filesystem") ||
+        hasWindowsPathAlias(candidatePath, "filesystem")) {
+        return false;
+    }
     if (!isPathInside(basePath, candidatePath)) {
         return false;
     }
     const baseReal = safeRealpathSync(basePath, opts?.cache);
     const candidateReal = safeRealpathSync(candidatePath, opts?.cache);
+    if ((baseReal !== null && hasWindowsPathAlias(baseReal, "filesystem")) ||
+        (candidateReal !== null && hasWindowsPathAlias(candidateReal, "filesystem"))) {
+        return false;
+    }
     if (!baseReal || !candidateReal) {
         return opts?.requireRealpath === false;
     }
@@ -117,7 +126,7 @@ export function isPathInsideWithRealpath(basePath, candidatePath, opts) {
 }
 export function safeStatSync(targetPath) {
     try {
-        return fs.statSync(targetPath);
+        return fs.statSync(pathForWindowsFilesystem(targetPath));
     }
     catch {
         return null;
@@ -145,11 +154,13 @@ export function splitSafeRelativePath(relativePath) {
             throw new FsSafeError("invalid-path", "relative path must not contain a drive letter");
         }
     }
+    assertNoWindowsPathAlias(relativePath, "relative", "relative path uses a Windows filesystem namespace alias");
     return segments;
 }
 export function resolveSafeRelativePath(rootDir, relativePath) {
-    const root = path.resolve(rootDir);
-    const target = path.resolve(root, ...splitSafeRelativePath(relativePath));
+    assertNoWindowsPathAlias(rootDir, "filesystem", "root dir uses a Windows filesystem namespace alias");
+    const root = resolvePathPreservingWindowsRoot(rootDir);
+    const target = resolvePathFromBasePreservingWindowsRoot(root, ...splitSafeRelativePath(relativePath));
     if (!isPathInside(root, target)) {
         throw new FsSafeError("outside-workspace", "relative path escapes root");
     }

package/dist/permissions-windows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions-windows.d.ts","sourceRoot":"","sources":["../src/permissions-windows.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKpH,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAyEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,sBAAsB,CAAC;CAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CA6C3B;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAKf;AAiED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAgBvF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAgBjK;AAiCD,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuCxP;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAKpG;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMzJ"}
+{"version":3,"file":"permissions-windows.d.ts","sourceRoot":"","sources":["../src/permissions-windows.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMpH,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAyEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,sBAAsB,CAAC;CAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CAmD3B;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAKf;AAiED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAgBvF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAgBjK;AAiCD,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA2CxP;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAKpG;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMzJ"}

package/dist/permissions-windows.js

@@ -5,6 +5,7 @@ import { safeStat } from "./permissions.js";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
 import { resolveWindowsSystemCommand } from "./windows-command.js";
 import { inspectWindowsOwner } from "./windows-owner.js";
+import { hasWindowsPathAlias } from "./windows-path-alias.js";
 const INHERIT_FLAGS = new Set(["I", "OI", "CI", "IO", "NP"]);
 const WORLD_PRINCIPALS = new Set(["everyone", "users", "builtin\\users", "authenticated users", "nt authority\\authenticated users", "anonymous logon", "nt authority\\anonymous logon", "guests", "builtin\\guests", "interactive", "nt authority\\interactive", "network", "nt authority\\network", "local"]);
 const TRUSTED_BASE = new Set([
@@ -69,9 +70,6 @@ function inspectWindowsPermissionsNative(params) {
     }
 }
 export async function inspectWindowsPermissions(params) {
-    const native = inspectWindowsPermissionsNative(params);
-    if (native)
-        return native;
     const unverified = {
         ok: true,
         isSymlink: params.stat.isSymlink,
@@ -84,6 +82,15 @@ export async function inspectWindowsPermissions(params) {
         worldReadable: false,
         groupReadable: false,
     };
+    if (hasWindowsPathAlias(params.targetPath, "filesystem", "win32")) {
+        return {
+            ...unverified,
+            error: "Path uses a Windows filesystem namespace alias",
+        };
+    }
+    const native = inspectWindowsPermissionsNative(params);
+    if (native)
+        return native;
     const owner = await inspectWindowsOwner({
         targetPath: params.targetPath,
         env: params.opts?.env,
@@ -270,6 +277,10 @@ export async function inspectWindowsAcl(targetPath, opts) {
         const error = new Error("Windows ACL principal SID translation failed");
         return summarizeWindowsOwnerAcl({ error: String(error), errorCause: error });
     }
+    if (hasWindowsPathAlias(targetPath, "filesystem", "win32")) {
+        const error = new Error("Path uses a Windows filesystem namespace alias");
+        return summarizeWindowsOwnerAcl({ error: String(error), errorCause: error });
+    }
     let owner;
     if (process.platform === "win32" && opts?.env === undefined && opts?.exec === undefined) {
         try {

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAuD1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAYT;AASD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,sFAAsF;IACtF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA8BF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAK1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA0E1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAYT;AASD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD"}