@openclaw/fs-safe 0.12.0 → 0.13.0

package/dist/directory-mode-node.js

@@ -1,10 +1,10 @@
 import fsSync, { constants } from "node:fs";
 import fs from "node:fs/promises";
 import { FsSafeError } from "./errors.js";
-import { inspectDirectoryIdentity } from "./directory-guard.js";
-import { inspectFileIdentity } from "./strict-file-identity.js";
+import { inspectDirectoryIdentity, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertOwnedDirectory, ownDirectoryMode } from "./directory-mode-owner.js";
-function searchOnlyFlags() {
+export function nodeDirectorySearchOnlyFlags() {
     if (process.arch !== "x64" && process.arch !== "arm64")
         return undefined;
     // Darwin SDK O_SEARCH = O_EXEC (0x40000000) | O_DIRECTORY, on x64/arm64.
@@ -41,7 +41,7 @@ export async function pinNodeDirectoryForMode(dirPath, options = {}) {
     const handle = await fs.open(dirPath, constants.O_RDONLY | flags).catch(async (error) => {
         if (error.code !== "EACCES")
             throw error;
-        const route = searchOnlyFlags();
+        const route = nodeDirectorySearchOnlyFlags();
         if (!route)
             throw error;
         proc = route.proc;
@@ -91,3 +91,101 @@ export async function pinNodeDirectoryForMode(dirPath, options = {}) {
         throw error;
     }
 }
+/** Synchronous counterpart with the same no-follow, identity, and owner checks. */
+export function pinNodeDirectoryForModeSync(dirPath, options = {}) {
+    const expected = inspectDirectoryIdentitySync(dirPath, options.expectedIdentity);
+    const assertOwner = (stat) => {
+        if (options.ownerUid !== undefined && stat.uid !== BigInt(options.ownerUid)) {
+            throw new FsSafeError("not-owned", "directory mode target must retain its expected owner");
+        }
+    };
+    assertOwner(expected);
+    if (process.platform === "win32") {
+        return {
+            apply: (_mode, check) => {
+                check?.();
+                assertOwner(inspectDirectoryIdentitySync(dirPath, expected));
+                check?.();
+            },
+            close: () => undefined,
+        };
+    }
+    if ([constants.O_DIRECTORY, constants.O_NOFOLLOW, constants.O_NONBLOCK, constants.O_RDONLY]
+        .some((flag) => typeof flag !== "number")) {
+        throw new FsSafeError("helper-unavailable", "no-follow directory mode descriptors are unavailable");
+    }
+    const flags = constants.O_DIRECTORY | constants.O_NOFOLLOW | constants.O_NONBLOCK;
+    let fd;
+    let proc = false;
+    try {
+        fd = fsSync.openSync(dirPath, constants.O_RDONLY | flags);
+    }
+    catch (error) {
+        if (error.code !== "EACCES")
+            throw error;
+        const route = nodeDirectorySearchOnlyFlags();
+        if (!route)
+            throw error;
+        proc = route.proc;
+        fd = fsSync.openSync(dirPath, route.flags | flags);
+    }
+    let closed = false;
+    const inspect = () => {
+        if (closed)
+            throw new FsSafeError("path-mismatch", "directory mode descriptor is closed");
+        const stat = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), expected);
+        assertOwnedDirectory(expected, stat);
+        assertOwner(stat);
+        inspectDirectoryIdentitySync(dirPath, expected);
+        return Number(stat.mode & 4095n);
+    };
+    const procPath = `/proc/self/fd/${fd}`;
+    const assertProcAuthority = () => {
+        if (fsSync.statfsSync("/proc/self/fd", { bigint: true }).type !== 0x9fa0n) {
+            throw new FsSafeError("path-mismatch", "directory mode requires a trusted procfs fd namespace");
+        }
+        const opened = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), expected);
+        const followed = inspectFileIdentitySync(() => fsSync.statSync(procPath, { bigint: true }), expected);
+        assertOwnedDirectory(opened, followed);
+        assertOwner(opened);
+        assertOwner(followed);
+    };
+    try {
+        inspect();
+        return {
+            apply: (mode, check) => {
+                mode &= 0o7777;
+                check?.();
+                const currentMode = inspect();
+                check?.();
+                if (currentMode !== mode) {
+                    if (proc)
+                        assertProcAuthority();
+                    check?.();
+                    inspect();
+                    if (proc)
+                        fsSync.chmodSync(procPath, mode);
+                    else
+                        fsSync.fchmodSync(fd, mode);
+                    if (proc)
+                        assertProcAuthority();
+                }
+                const finalMode = inspect();
+                check?.();
+                if (finalMode !== mode) {
+                    throw new FsSafeError("path-mismatch", "directory final mode could not be verified");
+                }
+            },
+            close: () => {
+                if (closed)
+                    return;
+                closed = true;
+                fsSync.closeSync(fd);
+            },
+        };
+    }
+    catch (error) {
+        fsSync.closeSync(fd);
+        throw error;
+    }
+}

package/dist/effective-uid.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveEffectiveUid(): number;
+//# sourceMappingURL=effective-uid.d.ts.map

package/dist/effective-uid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effective-uid.d.ts","sourceRoot":"","sources":["../src/effective-uid.ts"],"names":[],"mappings":"AAUA,wBAAgB,mBAAmB,IAAI,MAAM,CAe5C"}

package/dist/effective-uid.js

@@ -0,0 +1,25 @@
+function isValidUid(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function unavailable(cause) {
+    return new Error("Effective user identity is unavailable.", {
+        ...(cause === undefined ? {} : { cause }),
+    });
+}
+export function resolveEffectiveUid() {
+    const provider = process.geteuid;
+    if (typeof provider !== "function") {
+        throw unavailable();
+    }
+    let uid;
+    try {
+        uid = provider.call(process);
+    }
+    catch (cause) {
+        throw unavailable(cause);
+    }
+    if (!isValidUid(uid)) {
+        throw unavailable();
+    }
+    return uid;
+}

package/dist/file-handle-transfer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-handle-transfer.d.ts","sourceRoot":"","sources":["../src/file-handle-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAWnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAEF,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAGD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,OAAO,EAAE,qBAAqB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,MAAM,CAAC,CAyBjB"}
+{"version":3,"file":"file-handle-transfer.d.ts","sourceRoot":"","sources":["../src/file-handle-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAWnD,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CACnC,CAAC;AAkDF,uFAAuF;AACvF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,CAAC,CA0CjB;AAGD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,UAAU,GAAG,MAAM,EAC3B,OAAO,EAAE,qBAAqB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/file-handle-transfer.js

@@ -3,61 +3,132 @@ import { FsSafeError } from "./errors.js";
 import { assertSynchronousCallbackResult, composeMutationAssertions, rethrowMutationAuthorityError, } from "./mutation-authority.js";
 import { writeAllToFile } from "./write-file-handle.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
+const NO_CALLBACK_ARGUMENTS = Object.freeze([]);
+function defineReceiverValue(receiver, key, value) {
+    Object.defineProperty(receiver, key, {
+        value, enumerable: true, writable: true, configurable: true,
+    });
+}
+function copyTransferReceiver(options, maxBytes, sizeHint, signal, onChunk, assertBeforeMutation) {
+    const receiver = {};
+    const spreadSource = Object(options);
+    // Preserve the former late object-spread boundary, including proxy traps and
+    // unrelated getter failures. Authority-bearing values stay on their early
+    // snapshots, while descriptors still run in original own-key order.
+    for (const key of Reflect.ownKeys(spreadSource)) {
+        if (!Object.getOwnPropertyDescriptor(spreadSource, key)?.enumerable)
+            continue;
+        let value;
+        switch (key) {
+            case "maxBytes":
+                value = maxBytes;
+                break;
+            case "signal":
+                value = signal;
+                break;
+            case "onChunk":
+                value = onChunk;
+                break;
+            case "assertBeforeMutation":
+                value = assertBeforeMutation;
+                break;
+            default: value = Reflect.get(spreadSource, key);
+        }
+        // Create a data property so an enumerable __proto__ key cannot alter the
+        // ordinary receiver prototype, matching object spread.
+        defineReceiverValue(receiver, key, value);
+    }
+    // Match the explicit fields that followed the former spread. Updating an
+    // existing key retains its original position; absent keys append in order.
+    defineReceiverValue(receiver, "maxBytes", maxBytes);
+    defineReceiverValue(receiver, "sizeHint", sizeHint);
+    defineReceiverValue(receiver, "targetPosition", 0);
+    defineReceiverValue(receiver, "assertBeforeMutation", assertBeforeMutation);
+    return receiver;
+}
 /** Copies caller-owned regular files from offset zero without moving either cursor. */
 export async function copyFileHandle(source, target, options = {}) {
-    options.signal?.throwIfAborted();
+    // Snapshot caller-owned options before the first await. This preserves
+    // inherited/non-enumerable callbacks and prevents accessor mutation from
+    // replacing cancellation or mutation authority mid-transfer.
+    const signal = options.signal;
+    signal?.throwIfAborted();
     const maxBytes = normalizeMaxBytes(options.maxBytes);
+    const onChunk = options.onChunk;
+    const assertBeforeMutation = composeMutationAssertions(undefined, options.assertBeforeMutation);
     const sourceStat = await inspectFileIdentity(() => {
-        options.signal?.throwIfAborted();
+        signal?.throwIfAborted();
         return source.stat({ bigint: true });
     });
-    options.signal?.throwIfAborted();
+    signal?.throwIfAborted();
     if (!sourceStat.isFile())
         throw new FsSafeError("not-file", "copy source handle must be a regular file");
     if (maxBytes !== undefined && Number.isFinite(maxBytes) && sourceStat.size > BigInt(maxBytes)) {
         throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes`);
     }
     const targetStat = await inspectFileIdentity(() => {
-        options.signal?.throwIfAborted();
+        signal?.throwIfAborted();
         return target.stat({ bigint: true });
     });
-    options.signal?.throwIfAborted();
+    signal?.throwIfAborted();
     if (!targetStat.isFile())
         throw new FsSafeError("not-file", "copy target handle must be a regular file");
     if (sourceStat.dev === targetStat.dev && sourceStat.ino === targetStat.ino) {
         throw new FsSafeError("path-alias", "copy source and target handles refer to the same file");
     }
-    return await transferFileHandle(source, target, {
-        ...options,
-        maxBytes,
-        sizeHint: Number(sourceStat.size),
-        targetPosition: 0,
-        assertBeforeMutation: composeMutationAssertions(undefined, options.assertBeforeMutation),
-    }).catch(rethrowMutationAuthorityError);
+    const sizeHint = Number(sourceStat.size);
+    const callbackThis = copyTransferReceiver(options, maxBytes, sizeHint, signal, onChunk, assertBeforeMutation);
+    const beforeWrite = () => {
+        signal?.throwIfAborted();
+        assertBeforeMutation?.();
+    };
+    return await transferFileHandleCore(source, target, sizeHint, maxBytes, 0, signal, onChunk, beforeWrite, callbackThis).catch(rethrowMutationAuthorityError);
 }
 // Root.copyIn supplies already-admitted identities and retains its owned target cursor.
-export async function transferFileHandle(source, target, options) {
-    const maxBytes = options.maxBytes ?? Infinity;
-    const buffer = Buffer.allocUnsafe(Math.min(512 * 1024, Math.max(64 * 1024, options.sizeHint), maxBytes + 1));
+export function transferFileHandle(source, target, options) {
+    try {
+        const maxBytes = options.maxBytes;
+        const sizeHint = options.sizeHint;
+        const targetPosition = options.targetPosition;
+        const signal = options.signal;
+        const onChunk = options.onChunk;
+        const assertBeforeMutation = options.assertBeforeMutation;
+        const beforeWrite = signal === undefined && assertBeforeMutation === undefined
+            ? undefined
+            : () => {
+                signal?.throwIfAborted();
+                if (assertBeforeMutation) {
+                    Reflect.apply(assertBeforeMutation, options, NO_CALLBACK_ARGUMENTS);
+                }
+            };
+        return transferFileHandleCore(source, target, sizeHint, maxBytes, targetPosition, signal, onChunk, beforeWrite, options);
+    }
+    catch (error) {
+        // Keep the former async-function contract for synchronous option getters.
+        return Promise.reject(error);
+    }
+}
+async function transferFileHandleCore(source, target, sizeHint, maxBytes, targetPosition, signal, onChunk, beforeWrite, callbackThis) {
+    const limit = maxBytes ?? Infinity;
+    const buffer = Buffer.allocUnsafe(Math.min(512 * 1024, Math.max(64 * 1024, sizeHint), limit + 1));
     let position = 0;
     while (true) {
-        options.signal?.throwIfAborted();
-        const { bytesRead } = await source.read(buffer, 0, Math.min(buffer.length, maxBytes - position + 1), position);
-        options.signal?.throwIfAborted();
-        if (bytesRead > maxBytes - position) {
-            throw new FsSafeError("too-large", `file exceeds limit of ${maxBytes} bytes`);
+        signal?.throwIfAborted();
+        const { bytesRead } = await source.read(buffer, 0, Math.min(buffer.length, limit - position + 1), position);
+        signal?.throwIfAborted();
+        if (bytesRead > limit - position) {
+            throw new FsSafeError("too-large", `file exceeds limit of ${limit} bytes`);
         }
         if (bytesRead === 0)
             return position;
         const chunk = buffer.subarray(0, bytesRead);
-        if (options.onChunk)
-            assertSynchronousCallbackResult(options.onChunk(chunk), "onChunk");
+        if (onChunk) {
+            const returned = Function.prototype.call.call(onChunk, callbackThis, chunk);
+            assertSynchronousCallbackResult(returned, "onChunk");
+        }
         await writeAllToFile(target, chunk, {
-            position: options.targetPosition === undefined ? undefined : options.targetPosition + position,
-            assertBeforeMutation: () => {
-                options.signal?.throwIfAborted();
-                options.assertBeforeMutation?.();
-            },
+            position: targetPosition === undefined ? undefined : targetPosition + position,
+            assertBeforeMutation: beforeWrite,
         });
         position += bytesRead;
     }

package/dist/file-hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-hash.d.ts","sourceRoot":"","sources":["../src/file-hash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAInE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,CAAC;AAClD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,GAAE,aAAa,GAAG,SAA8B,EACtD,EAAE,QAAmB,EAAE,MAAM,EAAE,GAAE,iBAAsB,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAwD3B;AAyDD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAuDD,8FAA8F;AAC9F,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAMlB"}
+{"version":3,"file":"file-hash.d.ts","sourceRoot":"","sources":["../src/file-hash.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAInD,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAKnE,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,CAAC;AAClD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAsB,cAAc,CAClC,MAAM,EAAE,UAAU,EAClB,MAAM,GAAE,aAAa,GAAG,SAA8B,EACtD,EAAE,QAAmB,EAAE,MAAM,EAAE,GAAE,iBAAsB,GACtD,OAAO,CAAC,gBAAgB,CAAC,CAwD3B;AA0DD,wBAAsB,UAAU,CAC9B,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAwDD,8FAA8F;AAC9F,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,gBAAgB,CAMlB"}

package/dist/file-hash.js

@@ -6,6 +6,7 @@ import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
 import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { inspectFileIdentity, inspectFileIdentitySync } from "./strict-file-identity.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export async function hashFileHandle(handle, native = getNativeBinding(), { maxBytes = Infinity, signal } = {}) {
     signal?.throwIfAborted();
     const stat = fsSync.fstatSync(handle.fd);
@@ -88,6 +89,7 @@ function rethrowHashOpenError(error) {
     throw error;
 }
 async function hashPath(filePath, options) {
+    assertNoWindowsPathAlias(filePath, "filesystem", "SHA-256 path uses a Windows filesystem namespace alias");
     const before = await inspectFileIdentity(() => hashPathIdentity(filePath));
     let handle;
     try {
@@ -145,6 +147,7 @@ function hashDescriptorSync(fd, { maxBytes = Infinity, signal }) {
     }
 }
 function hashPathSync(filePath, options) {
+    assertNoWindowsPathAlias(filePath, "filesystem", "SHA-256 path uses a Windows filesystem namespace alias");
     const before = inspectFileIdentitySync(() => hashPathIdentity(filePath));
     let fd;
     try {

package/dist/file-lock-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-lock-sync.d.ts","sourceRoot":"","sources":["../src/file-lock-sync.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EASL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,MAAM,0BAA0B,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,QAAQ,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,iBAAiB,EAAE,KAAK,CAAC;KAC1B,KAAK,OAAO,CAAC;IACd,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,OAAO,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC3D,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,IAAI,OAAO,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC;IAChB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AAoJF,wBAAgB,mBAAmB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,GAC5C,kBAAkB,CA0MpB;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,EAC7C,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAOH"}
+{"version":3,"file":"file-lock-sync.d.ts","sourceRoot":"","sources":["../src/file-lock-sync.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EASL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AAWnC,OAAO,KAAK,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,yBAAyB,CAAC;AAQjC,MAAM,MAAM,0BAA0B,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC,aAAa,CAAC,EAAE,wBAAwB,CAAC;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,QAAQ,CAAC;IACxB,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,iBAAiB,EAAE,KAAK,CAAC;KAC1B,KAAK,OAAO,CAAC;IACd,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,wBAAwB,KAAK,OAAO,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,0BAA0B,KAAK,IAAI,CAAC;IAC3D,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,IAAI,OAAO,CAAC;IAC3B,OAAO,IAAI,IAAI,CAAC;IAChB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;CAC1B,CAAC;AA8JF,wBAAgB,mBAAmB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,GAC5C,kBAAkB,CA4NpB;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,CAAC,QAAQ,CAAC,EAC7C,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAOH"}

package/dist/file-lock-sync.js

@@ -5,8 +5,10 @@ import { readSidecarLockSnapshotSync, readSidecarLockRawSnapshotSync, parseSidec
 import { computeSidecarLockDelayMs, isTransientLockFileDenial, maxTransientLockDenials, sidecarLockPayloadCreatedAtMs, validateSidecarLockStaleMs, validateSidecarLockCompromiseCheckIntervalMs, validateSidecarLockRetryOptions, validateSidecarLockTimeoutMs, } from "./sidecar-lock-policy.js";
 import { getFsSafeLockConfig } from "./lock-config.js";
 import { sleepSync } from "./timing.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 import { realpathSync } from "./realpath.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { createSuppressedError } from "./suppressed-error.js";
 const SYNC_HELD_LOCKS_KEY = Symbol.for("fsSafe.syncSidecarLocks");
 const SYNC_CLEANUP_REGISTERED_KEY = Symbol.for("fsSafe.syncSidecarLockCleanupRegistered");
 const SYNC_CLEANUP_HANDLER_KEY = Symbol.for("fsSafe.syncSidecarLockCleanupHandler");
@@ -97,26 +99,36 @@ function canonicalLockParentSync(parent) {
 }
 function normalizeTargetPath(targetPath) {
     const resolved = path.resolve(targetPath);
+    assertNoWindowsPathAlias(resolved);
     fs.mkdirSync(recursiveMkdirPath(path.dirname(resolved)), { recursive: true });
+    let parent;
     try {
-        return path.join(canonicalLockParentSync(path.dirname(resolved)), path.basename(resolved));
+        parent = canonicalLockParentSync(path.dirname(resolved));
     }
     catch {
         return resolved;
     }
+    assertNoWindowsPathAlias(parent);
+    const normalized = path.join(parent, path.basename(resolved));
+    assertNoWindowsPathAlias(normalized);
+    return normalized;
 }
 function boundedLockPath(lockPath, lockRoot) {
     const resolved = path.resolve(lockPath);
+    assertNoWindowsPathAlias(resolved);
     if (!lockRoot)
         return resolved;
     relativeSidecarLockPath(lockRoot, resolved);
     const parent = path.dirname(resolved);
     const parentReal = canonicalLockParentSync(parent);
+    assertNoWindowsPathAlias(parentReal);
     const parentRelative = path.relative(lockRoot.rootReal, parentReal);
     if (parentRelative === ".." || parentRelative.startsWith(`..${path.sep}`) || path.isAbsolute(parentRelative)) {
         throw new FsSafeError("outside-workspace", "sidecar lock parent is outside lockRoot");
     }
-    return path.join(parentReal, path.basename(resolved));
+    const bounded = path.join(parentReal, path.basename(resolved));
+    assertNoWindowsPathAlias(bounded);
+    return bounded;
 }
 function defaultShouldReclaim(snapshot, staleMs, nowMs) {
     const createdAtMs = sidecarLockPayloadCreatedAtMs(snapshot.payload);
@@ -145,8 +157,12 @@ export function acquireFileLockSync(targetPath, options) {
     const staleMs = options.staleMs ?? defaults.staleMs ?? 30_000;
     validateSidecarLockStaleMs(staleMs);
     validateSidecarLockCompromiseCheckIntervalMs(options.compromiseCheckIntervalMs);
+    const explicitLockPath = options.lockPath;
+    assertNoWindowsPathAlias(targetPath);
+    if (explicitLockPath !== undefined)
+        assertNoWindowsPathAlias(explicitLockPath);
     const normalizedTargetPath = normalizeTargetPath(targetPath);
-    const lockPath = boundedLockPath(options.lockPath ?? `${normalizedTargetPath}.lock`, options.lockRoot);
+    const lockPath = boundedLockPath(explicitLockPath ?? `${normalizedTargetPath}.lock`, options.lockRoot);
     const heldLocks = getSyncHeldLocks();
     const held = heldLocks.get(normalizedTargetPath);
     if (held &&
@@ -256,10 +272,24 @@ export function acquireFileLockSync(targetPath, options) {
         }
         catch (error) {
             if (fd !== undefined) {
-                const failed = { payload: null, stat: fs.fstatSync(fd) };
-                fs.closeSync(fd);
+                const failed = { payload: null };
+                try {
+                    failed.stat = fs.fstatSync(fd);
+                }
+                catch {
+                    // Missing identity leaves the sidecar in place, but must not skip close.
+                }
+                const failedFd = fd;
+                // A close error may still free the number; consume ownership before closing.
                 fd = undefined;
-                removeSidecarLockIfUnchangedSync(lockPath, failed);
+                try {
+                    fs.closeSync(failedFd);
+                    if (failed.stat)
+                        removeSidecarLockIfUnchangedSync(lockPath, failed);
+                }
+                catch (cleanupError) {
+                    throw createSuppressedError(error, cleanupError, "file lock acquisition and cleanup both failed");
+                }
             }
             if (lockFileCreateDenied && retryLockFileDenial(error))
                 continue;

package/dist/file-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-lock.d.ts","sourceRoot":"","sources":["../src/file-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAC3D,MAAM,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE7D,MAAM,MAAM,sBAAsB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CACjF,yBAAyB,CAAC,QAAQ,CAAC,EACnC,YAAY,GAAG,SAAS,CACzB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAC/C,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACrD,YAAY,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9C,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,QAAQ,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClD,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,IAAI,CAAC;IACd,WAAW,IAAI,iBAAiB,EAAE,CAAC;CACpC,CAAC;AAmBF,wBAAsB,eAAe,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,cAAc,CAAC,CAGzB;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAGZ;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAelE;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzF"}
+{"version":3,"file":"file-lock.d.ts","sourceRoot":"","sources":["../src/file-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAC3D,MAAM,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAE7D,MAAM,MAAM,sBAAsB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CACjF,yBAAyB,CAAC,QAAQ,CAAC,EACnC,YAAY,GAAG,SAAS,CACzB,GAAG;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAC/C,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACrD,YAAY,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9C,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,QAAQ,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClD,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAAC;IACd,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,KAAK,IAAI,IAAI,CAAC;IACd,WAAW,IAAI,iBAAiB,EAAE,CAAC;CACpC,CAAC;AAiCF,wBAAsB,eAAe,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,GACxC,OAAO,CAAC,cAAc,CAAC,CAGzB;AAED,wBAAsB,YAAY,CAAC,CAAC,EAAE,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5E,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,sBAAsB,CAAC,QAAQ,CAAC,EACzC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAGZ;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAmBlE;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzF"}

package/dist/file-lock.js

@@ -5,13 +5,29 @@ function resolveFileLockManagerKey(targetPath, managerKey) {
     return managerKey ?? `fs-safe.file-lock:${targetPath}`;
 }
 function withLockDefaults(options) {
+    const { managerKey: _managerKey, lockPath } = options;
+    const acquireOptions = {};
+    for (const key of Reflect.ownKeys(options)) {
+        // Node 22 object-rest can read excluded accessors; exclude before copying.
+        if (key === "managerKey" || key === "lockPath")
+            continue;
+        if (!Object.getOwnPropertyDescriptor(options, key)?.enumerable)
+            continue;
+        Object.defineProperty(acquireOptions, key, {
+            value: Reflect.get(options, key),
+            enumerable: true,
+            writable: true,
+            configurable: true,
+        });
+    }
     const defaults = getFsSafeLockConfig();
     return {
-        ...options,
-        retry: options.retry ?? defaults.retry,
-        staleMs: options.staleMs ?? defaults.staleMs ?? 30_000,
-        staleRecovery: options.staleRecovery ?? defaults.staleRecovery,
-        timeoutMs: options.timeoutMs ?? defaults.timeoutMs,
+        ...acquireOptions,
+        retry: acquireOptions.retry ?? defaults.retry,
+        staleMs: acquireOptions.staleMs ?? defaults.staleMs ?? 30_000,
+        staleRecovery: acquireOptions.staleRecovery ?? defaults.staleRecovery,
+        timeoutMs: acquireOptions.timeoutMs ?? defaults.timeoutMs,
+        ...(lockPath === undefined ? {} : { lockPath }),
     };
 }
 export async function acquireFileLock(targetPath, options) {
@@ -26,12 +42,16 @@ export function createFileLockManager(key) {
     const manager = createSidecarLockManager(key);
     return {
         acquire: async (targetPath, options) => {
-            const { managerKey: _managerKey, ...acquireOptions } = options;
-            return await manager.acquire({ ...withLockDefaults(acquireOptions), targetPath });
+            return await manager.acquire({
+                ...withLockDefaults(options),
+                targetPath,
+            });
         },
         withLock: async (targetPath, options, fn) => {
-            const { managerKey: _managerKey, ...acquireOptions } = options;
-            return await manager.withLock({ ...withLockDefaults(acquireOptions), targetPath }, fn);
+            return await manager.withLock({
+                ...withLockDefaults(options),
+                targetPath,
+            }, fn);
         },
         drain: manager.drain,
         reset: manager.reset,

package/dist/file-observation.d.ts

@@ -1,4 +1,4 @@
-type FailureKind = "identity" | "resolution" | `open:${string}` | `exclusive-create:${string}` | `unlinked:${string}` | `changed:${string}`;
+type FailureKind = "identity" | "resolution" | `open:${string}` | `exclusive-create:${string}` | `unlinked:${string}` | `changed:${string}` | `stat-leaf-missing:${string}`;
 export declare function recordFileObservationFailure(error: unknown, kind: FailureKind): void;
 export declare function isFileObservationFailure(error: unknown, kind: FailureKind): boolean;
 export declare function fileObservation(): {

package/dist/file-observation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-observation.d.ts","sourceRoot":"","sources":["../src/file-observation.ts"],"names":[],"mappings":"AAEA,KAAK,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,MAAM,EAAE,GAAG,oBAAoB,MAAM,EAAE,GAAG,YAAY,MAAM,EAAE,GAAG,WAAW,MAAM,EAAE,CAAC;AAG5I,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAMpF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAEnF;AAGD,wBAAgB,eAAe;IAG3B,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC;IAC7B,GAAG,QAAQ,OAAO,QAAQ,WAAW,GAAG,OAAO;EAElD"}
+{"version":3,"file":"file-observation.d.ts","sourceRoot":"","sources":["../src/file-observation.ts"],"names":[],"mappings":"AAEA,KAAK,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,MAAM,EAAE,GAAG,oBAAoB,MAAM,EAAE,GAAG,YAAY,MAAM,EAAE,GAAG,WAAW,MAAM,EAAE,GAAG,qBAAqB,MAAM,EAAE,CAAC;AAG5K,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAMpF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAEnF;AAGD,wBAAgB,eAAe;IAG3B,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC;IAC7B,GAAG,QAAQ,OAAO,QAAQ,WAAW,GAAG,OAAO;EAElD"}

package/dist/file-store-boundary.d.ts

@@ -1,8 +1,12 @@
+import { type BigIntStats } from "node:fs";
 import type { Readable } from "node:stream";
-import { type SyncDirectoryGuard } from "./directory-guard.js";
+import type { SyncDirectoryGuard } from "./directory-guard.js";
 import { type Root } from "./root.js";
 import { prepareSecretFileWrite } from "./secret-file.js";
-export type SyncParentGuard = SyncDirectoryGuard;
+export type SyncParentGuard = SyncDirectoryGuard & {
+    /** Exact authority retained separately from the legacy numeric durability receipt. */
+    readonly exactStat: BigIntStats;
+};
 export declare function ensureParentInRoot(scopedRoot: Root, relativePath: string, mode: number): Promise<void>;
 export declare function openWritableStoreRoot(params: {
     rootDir: string;

package/dist/file-store-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-store-boundary.d.ts","sourceRoot":"","sources":["../src/file-store-boundary.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIvD,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAA4C,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAGhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAK1D,MAAM,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAOjD,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,IAAI,EAChB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,GACnD,OAAO,CAAC,IAAI,CAAC,CASf;AAsCD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAwC1D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAWrE;AAUD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,eAAe,CAOlB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,eAAe,GAAG,OAAO,CAAC;CAC1C,GAAG,eAAe,CAyDlB"}
+{"version":3,"file":"file-store-boundary.d.ts","sourceRoot":"","sources":["../src/file-store-boundary.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAGnD,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAO/D,OAAO,EAA4C,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC;AAGhF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAK1D,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG;IACjD,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;CACjC,CAAC;AAOF,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,IAAI,EAChB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,GACnD,OAAO,CAAC,IAAI,CAAC,CAUf;AAsCD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAwC1D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAMrE;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,eAAe,CASlB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,eAAe,GAAG,OAAO,CAAC;CAC1C,GAAG,eAAe,CAUlB"}