@openclaw/fs-safe 0.12.0 → 0.13.0

package/dist/file-store-boundary.js

@@ -1,20 +1,19 @@
-import syncFs from "node:fs";
+import syncFs, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createByteLimitTransform } from "./bounded-read-stream.js";
 import { normalizeMaxBytes } from "./byte-budget.js";
 import { pipeline } from "node:stream/promises";
-import { assertSyncDirectoryGuard as assertDirectoryGuardSync, createSyncDirectoryGuard, } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
-import { sameFileIdentity } from "./file-identity.js";
-import { isPathInside, isPathRelativeEscape } from "./path.js";
+import { assertSyncStoreDirectoryReceipt, ensureSyncStoreDirectory, } from "./file-store-sync-directory.js";
+import { isPathInside } from "./path.js";
 import { resolveOpenedFileRealPathForHandle, root } from "./root.js";
 import { ensureTrailingSep } from "./root-context.js";
 import { RootHandle } from "./root-impl.js";
 import { prepareSecretFileWrite } from "./secret-file.js";
 import { resolveSecureTempRoot } from "./secure-temp-dir.js";
-import { realpathSync } from "./realpath.js";
 import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { assertNoWindowsPathAlias, pathForWindowsFilesystem } from "./windows-path-alias.js";
 function parentRelativePath(relativePath) {
     const parent = path.posix.dirname(relativePath);
     return parent === "." ? "" : parent;
@@ -28,6 +27,7 @@ export async function ensureParentInRoot(scopedRoot, relativePath, mode) {
     await chmodDirectoryInRootBestEffort(scopedRoot, parent, mode).catch(() => undefined);
 }
 export async function openWritableStoreRoot(params) {
+    assertNoWindowsPathAlias(params.rootDir, "filesystem", "store root uses a Windows filesystem namespace alias");
     const maxBytes = normalizeMaxBytes(params.maxBytes);
     await fs.mkdir(recursiveMkdirPath(params.rootDir), { recursive: true, mode: params.dirMode });
     await fs.chmod(params.rootDir, params.dirMode).catch(() => undefined);
@@ -38,6 +38,7 @@ export async function openPrivateStoreLockRoot(params) {
     // Bind to the admitted parent, never resolve a replacement into a fresh capability.
     return new RootHandle({
         rootDir: parentGuard.dir,
+        rootGuard: { dir: parentGuard.realPath, realPath: parentGuard.realPath, stat: parentGuard.stat },
         rootReal: parentGuard.realPath,
         rootWithSep: ensureTrailingSep(parentGuard.realPath),
         rootIdentity: { dev: parentGuard.stat.dev, ino: parentGuard.stat.ino },
@@ -116,27 +117,15 @@ export async function writeStreamToTempSource(params) {
     }
 }
 export function assertSyncDirectoryGuard(guard) {
-    try {
-        assertDirectoryGuardSync(guard);
-    }
-    catch (error) {
-        if (error instanceof FsSafeError && error.code === "path-mismatch") {
-            throw new FsSafeError("path-mismatch", "store directory changed during write", {
-                cause: error,
-            });
-        }
-        throw error;
-    }
-}
-function chmodDirectorySyncBestEffort(dir, mode) {
-    try {
-        syncFs.chmodSync(dir, mode);
-    }
-    catch {
-        // Best-effort on platforms that do not enforce POSIX modes.
-    }
+    assertSyncStoreDirectoryReceipt({
+        dir: guard.dir,
+        realPath: guard.realPath,
+        exactStat: guard.exactStat,
+    });
 }
 export function ensureParentSync(params) {
+    assertNoWindowsPathAlias(params.rootDir, "filesystem", "store root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(params.filePath, "filesystem", "store path uses a Windows filesystem namespace alias");
     return ensureStoreDirectorySync({
         rootDir: params.rootDir,
         targetDir: path.dirname(path.resolve(params.filePath)),
@@ -145,47 +134,13 @@ export function ensureParentSync(params) {
     });
 }
 export function ensureStoreDirectorySync(params) {
-    const rootDir = path.resolve(params.rootDir);
-    const dir = path.resolve(params.targetDir);
-    const relative = path.relative(rootDir, dir);
-    if (isPathRelativeEscape(relative)) {
-        throw new FsSafeError("outside-workspace", "file path escapes store root");
-    }
-    syncFs.mkdirSync(recursiveMkdirPath(rootDir), { recursive: true, mode: params.mode });
-    const rootStat = syncFs.lstatSync(rootDir);
-    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
-        throw new FsSafeError("not-file", `${params.messagePrefix} root must be a directory: ${rootDir}`);
-    }
-    const rootReal = realpathSync(rootDir);
-    chmodDirectorySyncBestEffort(rootDir, params.mode);
-    let current = rootDir;
-    for (const segment of path.relative(rootDir, dir).split(path.sep).filter(Boolean)) {
-        current = path.join(current, segment);
-        try {
-            const stat = syncFs.lstatSync(current);
-            if (stat.isSymbolicLink() || !stat.isDirectory()) {
-                throw new FsSafeError("not-file", `${params.messagePrefix} directory component must be a directory: ${current}`);
-            }
-        }
-        catch (error) {
-            if (error.code !== "ENOENT") {
-                throw error;
-            }
-            syncFs.mkdirSync(current, { mode: params.mode });
-        }
-        const currentRootStat = syncFs.lstatSync(rootDir);
-        const currentRootReal = realpathSync(rootDir);
-        const currentReal = realpathSync(current);
-        if (currentRootStat.isSymbolicLink() ||
-            !currentRootStat.isDirectory() ||
-            !sameFileIdentity(rootStat, currentRootStat) ||
-            currentRootReal !== rootReal ||
-            !isPathInside(rootReal, currentReal)) {
-            throw new FsSafeError("outside-workspace", `${params.messagePrefix} directory escapes root`);
-        }
-        chmodDirectorySyncBestEffort(current, params.mode);
-    }
-    const guard = createSyncDirectoryGuard(dir);
+    const receipt = ensureSyncStoreDirectory(params);
+    const guard = {
+        dir: receipt.dir,
+        realPath: receipt.realPath,
+        stat: syncFs.lstatSync(pathForWindowsFilesystem(receipt.dir)),
+        exactStat: receipt.exactStat,
+    };
     assertSyncDirectoryGuard(guard);
     return guard;
 }

package/dist/file-store-copy-source.d.ts

@@ -0,0 +1,5 @@
+export declare function readFileStoreCopySource(params: {
+    sourcePath: string;
+    maxBytes?: number;
+}): Promise<Buffer>;
+//# sourceMappingURL=file-store-copy-source.d.ts.map

package/dist/file-store-copy-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-store-copy-source.d.ts","sourceRoot":"","sources":["../src/file-store-copy-source.ts"],"names":[],"mappings":"AAMA,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BlB"}

package/dist/file-store-copy-source.js

@@ -0,0 +1,31 @@
+import fs from "node:fs";
+import { FsSafeError } from "./errors.js";
+import { assertFileStoreMaxBytes } from "./file-store-limit.js";
+import { readRegularFile } from "./regular-file.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
+export async function readFileStoreCopySource(params) {
+    assertNoWindowsPathAlias(params.sourcePath, "filesystem", "source path uses a Windows filesystem namespace alias");
+    const sourceStat = fs.lstatSync(params.sourcePath);
+    if (sourceStat.isSymbolicLink() || !sourceStat.isFile()) {
+        throw new FsSafeError("not-file", "source path is not a file");
+    }
+    assertFileStoreMaxBytes(sourceStat.size, params.maxBytes);
+    try {
+        return (await readRegularFile({ filePath: params.sourcePath, maxBytes: params.maxBytes }))
+            .buffer;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("regular file") || message.includes("not a regular file")) {
+            throw new FsSafeError("not-file", "source path is not a file", {
+                cause: error instanceof Error ? error : undefined,
+            });
+        }
+        if (params.maxBytes !== undefined && message.includes(`exceeds ${params.maxBytes} bytes`)) {
+            throw new FsSafeError("too-large", `file exceeds maximum size of ${params.maxBytes} bytes`, {
+                cause: error instanceof Error ? error : undefined,
+            });
+        }
+        throw error;
+    }
+}

package/dist/file-store-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-store-path.d.ts","sourceRoot":"","sources":["../src/file-store-path.ts"],"names":[],"mappings":"AAIA,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAe/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAS9E"}
+{"version":3,"file":"file-store-path.d.ts","sourceRoot":"","sources":["../src/file-store-path.ts"],"names":[],"mappings":"AAIA,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAe/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAY9E"}

package/dist/file-store-path.js

@@ -17,7 +17,10 @@ export function assertRelativePath(relativePath) {
 }
 export function resolveStorePath(rootDir, relativePath) {
     const key = assertRelativePath(relativePath);
-    const root = path.resolve(rootDir);
+    // FileStore constructors snapshot an absolute root before this helper runs.
+    // Do not re-resolve it: Node drops the trailing separator from an exact
+    // Windows namespace drive root such as `\\?\C:\`.
+    const root = path.isAbsolute(rootDir) ? rootDir : path.resolve(rootDir);
     // The immutable key already passed segment validation; keep the containment check.
     const target = path.resolve(root, key);
     if (!isPathInside(root, target)) {

package/dist/file-store-sync-directory.d.ts

@@ -0,0 +1,16 @@
+import { type BigIntStats } from "node:fs";
+type StoreMessagePrefix = "private store" | "store";
+export type SyncStoreDirectoryReceipt = Readonly<{
+    dir: string;
+    realPath: string;
+    exactStat: BigIntStats;
+}>;
+export declare function ensureSyncStoreDirectory(params: {
+    rootDir: string;
+    targetDir: string;
+    mode: number;
+    messagePrefix: StoreMessagePrefix;
+}): SyncStoreDirectoryReceipt;
+export declare function assertSyncStoreDirectoryReceipt(receipt: SyncStoreDirectoryReceipt): void;
+export {};
+//# sourceMappingURL=file-store-sync-directory.d.ts.map

package/dist/file-store-sync-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-store-sync-directory.d.ts","sourceRoot":"","sources":["../src/file-store-sync-directory.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAc/C,KAAK,kBAAkB,GAAG,eAAe,GAAG,OAAO,CAAC;AAOpD,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;CACxB,CAAC,CAAC;AAkVH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,kBAAkB,CAAC;CACnC,GAAG,yBAAyB,CA4D5B;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,yBAAyB,GACjC,IAAI,CAsBN"}

package/dist/file-store-sync-directory.js

@@ -0,0 +1,349 @@
+import fs, {} from "node:fs";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { isPathInside, isPathRelativeEscape } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { recursiveMkdirPath } from "./recursive-mkdir-path.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { createSuppressedError } from "./suppressed-error.js";
+import { assertNoWindowsPathAlias, pathForWindowsFilesystem, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+function changedStoreDirectory(messagePrefix, cause) {
+    return new FsSafeError("outside-workspace", `${messagePrefix} directory escapes root`, { cause });
+}
+function storeDirectoryRealPath(dir) {
+    const realPath = realpathSync(pathForWindowsFilesystem(dir));
+    assertNoWindowsPathAlias(realPath, "filesystem");
+    return realPath;
+}
+function inspectStoreDirectory(params) {
+    assertNoWindowsPathAlias(params.dir, "filesystem");
+    return inspectFileIdentitySync(() => {
+        const stat = fs.lstatSync(pathForWindowsFilesystem(params.dir), { bigint: true });
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            const subject = params.root ? "root" : "directory component";
+            throw new FsSafeError("not-file", `${params.messagePrefix} ${subject} must be a directory: ${params.dir}`);
+        }
+        return stat;
+    }, params.expected);
+}
+function observeStoreDirectory(params) {
+    return {
+        dir: params.dir,
+        stat: inspectStoreDirectory(params),
+    };
+}
+function inspectReceiptCurrent(receipt, messagePrefix, root) {
+    try {
+        const stat = inspectStoreDirectory({
+            dir: receipt.dir,
+            expected: receipt.stat,
+            messagePrefix,
+            root,
+        });
+        if (stat.dev !== receipt.stat.dev || stat.ino !== receipt.stat.ino) {
+            throw changedStoreDirectory(messagePrefix);
+        }
+        return stat;
+    }
+    catch (error) {
+        if (error instanceof FsSafeError && error.code === "outside-workspace")
+            throw error;
+        throw changedStoreDirectory(messagePrefix, error);
+    }
+}
+function assertRootCurrent(rootReceipt, rootReal, messagePrefix) {
+    const stat = inspectReceiptCurrent(rootReceipt, messagePrefix, true);
+    try {
+        if (storeDirectoryRealPath(rootReceipt.dir) !== rootReal) {
+            throw changedStoreDirectory(messagePrefix);
+        }
+    }
+    catch (error) {
+        if (error instanceof FsSafeError && error.code === "outside-workspace")
+            throw error;
+        throw changedStoreDirectory(messagePrefix, error);
+    }
+    return stat;
+}
+function assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix) {
+    const rootReceipt = receipts[0];
+    const targetIndex = receipts.length - 1;
+    const targetReceipt = receipts[targetIndex];
+    if (!rootReceipt || !targetReceipt) {
+        throw new FsSafeError("helper-failed", "store directory receipt is missing");
+    }
+    const rootStat = assertRootCurrent(rootReceipt, rootReal, messagePrefix);
+    if (targetIndex === 0)
+        return rootStat;
+    const parent = receipts[targetIndex - 1];
+    if (!parent)
+        throw new FsSafeError("helper-failed", "store directory receipt is missing");
+    if (targetIndex > 1)
+        inspectReceiptCurrent(parent, messagePrefix, false);
+    const targetStat = inspectReceiptCurrent(targetReceipt, messagePrefix, false);
+    if (path.dirname(targetReceipt.dir) !== parent.dir) {
+        throw changedStoreDirectory(messagePrefix);
+    }
+    return targetStat;
+}
+function assertModeTargetCurrent(receipts, rootReal, messagePrefix) {
+    const target = receipts.at(-1);
+    if (!target)
+        throw new FsSafeError("helper-failed", "store directory receipt is missing");
+    const stat = assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix);
+    let targetReal;
+    try {
+        targetReal = storeDirectoryRealPath(target.dir);
+    }
+    catch (error) {
+        throw changedStoreDirectory(messagePrefix, error);
+    }
+    if (!isPathInside(rootReal, targetReal))
+        throw changedStoreDirectory(messagePrefix);
+    assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix);
+    return stat;
+}
+function assertReceiptChain(receipts, rootReal, messagePrefix) {
+    const rootReceipt = receipts[0];
+    const finalReceipt = receipts.at(-1);
+    if (!rootReceipt || !finalReceipt) {
+        throw new FsSafeError("helper-failed", "store directory receipt is missing");
+    }
+    assertRootCurrent(rootReceipt, rootReal, messagePrefix);
+    let finalStat = rootReceipt.stat;
+    for (const [index, receipt] of receipts.entries()) {
+        if (index === 0)
+            continue;
+        finalStat = inspectReceiptCurrent(receipt, messagePrefix, false);
+    }
+    let finalReal;
+    try {
+        finalReal = storeDirectoryRealPath(finalReceipt.dir);
+    }
+    catch (error) {
+        throw changedStoreDirectory(messagePrefix, error);
+    }
+    if (!isPathInside(rootReal, finalReal))
+        throw changedStoreDirectory(messagePrefix);
+    assertRootCurrent(rootReceipt, rootReal, messagePrefix);
+    if (finalReceipt !== rootReceipt) {
+        finalStat = inspectReceiptCurrent(finalReceipt, messagePrefix, false);
+    }
+    return { finalReal, finalStat };
+}
+function directoryOpenFlags() {
+    const { O_DIRECTORY, O_NOFOLLOW, O_NONBLOCK, O_RDONLY } = fs.constants;
+    if ([O_DIRECTORY, O_NOFOLLOW, O_NONBLOCK, O_RDONLY]
+        .some((flag) => typeof flag !== "number")) {
+        throw new FsSafeError("helper-unavailable", "no-follow directory mode descriptors are unavailable");
+    }
+    return O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_NONBLOCK;
+}
+function directorySearchFlags() {
+    // Linux O_PATH descriptors cannot be fchmoded, and /proc/self/fd would
+    // reintroduce a pathname mutation. Darwin O_SEARCH remains descriptor-bound.
+    if (process.platform !== "darwin" ||
+        (process.arch !== "x64" && process.arch !== "arm64"))
+        return undefined;
+    const { O_DIRECTORY, O_NOFOLLOW, O_NONBLOCK } = fs.constants;
+    if ([O_DIRECTORY, O_NOFOLLOW, O_NONBLOCK].some((flag) => typeof flag !== "number")) {
+        return undefined;
+    }
+    // Darwin SDK O_SEARCH = O_EXEC (0x40000000) | O_DIRECTORY on supported Node hosts.
+    return 0x40000000 | O_DIRECTORY | O_NOFOLLOW | O_NONBLOCK;
+}
+function hasErrorCode(error, code) {
+    if (error && typeof error === "object") {
+        if (error.code === code)
+            return true;
+        const combined = error;
+        return (combined.error !== error && hasErrorCode(combined.error, code)) ||
+            (combined.suppressed !== error && hasErrorCode(combined.suppressed, code));
+    }
+    return false;
+}
+function openStoreDirectoryForMode(params) {
+    let openError;
+    try {
+        return fs.openSync(pathForWindowsFilesystem(params.receipt.dir), directoryOpenFlags());
+    }
+    catch (error) {
+        openError = error;
+    }
+    const searchFlags = hasErrorCode(openError, "EACCES") ? directorySearchFlags() : undefined;
+    if (searchFlags !== undefined) {
+        try {
+            return fs.openSync(pathForWindowsFilesystem(params.receipt.dir), searchFlags);
+        }
+        catch (searchError) {
+            openError = createSuppressedError(searchError, openError, "ordinary and search-only directory opens both failed");
+        }
+    }
+    try {
+        assertModeTargetCurrent(params.receipts, params.rootReal, params.messagePrefix);
+    }
+    catch (boundaryError) {
+        throw changedStoreDirectory(params.messagePrefix, createSuppressedError(boundaryError, openError, "directory acquisition and boundary revalidation both failed"));
+    }
+    if (hasErrorCode(openError, "EACCES")) {
+        throw new FsSafeError("permission-unverified", `${params.messagePrefix} directory cannot be safely mode-repaired through a Node descriptor`, { cause: openError });
+    }
+    throw openError;
+}
+function requestedDirectoryMode(mode) {
+    return BigInt(mode & 0o7777);
+}
+function inspectOpenedStoreDirectory(descriptor, receipt, messagePrefix) {
+    try {
+        const stat = inspectFileIdentitySync(() => fs.fstatSync(descriptor, { bigint: true }), receipt.stat);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            throw changedStoreDirectory(messagePrefix);
+        }
+        return stat;
+    }
+    catch (error) {
+        if (error instanceof FsSafeError && error.code === "outside-workspace")
+            throw error;
+        throw changedStoreDirectory(messagePrefix, error);
+    }
+}
+function finalizeDirectoryMode(params) {
+    const receipt = params.receipts.at(-1);
+    if (!receipt)
+        throw new FsSafeError("helper-failed", "store directory receipt is missing");
+    const requestedMode = requestedDirectoryMode(params.mode);
+    if ((receipt.stat.mode & 4095n) === requestedMode || process.platform === "win32") {
+        const current = assertAdmittedEdgeCurrent(params.receipts, params.rootReal, params.messagePrefix);
+        // Identity can remain stable while permissions change after the first receipt.
+        if (process.platform === "win32" || (current.mode & 4095n) === requestedMode) {
+            return { ...receipt, stat: current };
+        }
+    }
+    // Repair owns the stronger pre/post mode-target fence below, including an
+    // admission check on acquisition failure; no earlier admission is needed.
+    const descriptor = openStoreDirectoryForMode({
+        receipt,
+        receipts: params.receipts,
+        rootReal: params.rootReal,
+        messagePrefix: params.messagePrefix,
+    });
+    let finalStat;
+    let operationFailed = false;
+    let operationError;
+    try {
+        const opened = inspectOpenedStoreDirectory(descriptor, receipt, params.messagePrefix);
+        assertModeTargetCurrent(params.receipts, params.rootReal, params.messagePrefix);
+        if ((opened.mode & 4095n) !== requestedMode) {
+            fs.fchmodSync(descriptor, Number(requestedMode));
+        }
+        const finalized = inspectOpenedStoreDirectory(descriptor, receipt, params.messagePrefix);
+        const pathname = assertModeTargetCurrent(params.receipts, params.rootReal, params.messagePrefix);
+        if ((finalized.mode & 4095n) !== requestedMode ||
+            (pathname.mode & 4095n) !== requestedMode) {
+            throw new FsSafeError("insecure-permissions", `${params.messagePrefix} directory mode could not be finalized`);
+        }
+        finalStat = pathname;
+    }
+    catch (error) {
+        operationFailed = true;
+        operationError = error;
+    }
+    try {
+        fs.closeSync(descriptor);
+    }
+    catch (closeError) {
+        if (operationFailed) {
+            throw createSuppressedError(closeError, operationError, "store directory finalization and close both failed");
+        }
+        throw closeError;
+    }
+    if (operationFailed)
+        throw operationError;
+    if (!finalStat)
+        throw new FsSafeError("helper-failed", "store directory mode receipt is missing");
+    return { ...receipt, stat: finalStat };
+}
+export function ensureSyncStoreDirectory(params) {
+    assertNoWindowsPathAlias(params.rootDir, "filesystem", "store root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(params.targetDir, "filesystem", "store path uses a Windows filesystem namespace alias");
+    const rootDir = resolvePathPreservingWindowsRoot(params.rootDir);
+    const dir = resolvePathPreservingWindowsRoot(params.targetDir);
+    assertNoWindowsPathAlias(rootDir, "filesystem", "store root uses a Windows filesystem namespace alias");
+    assertNoWindowsPathAlias(dir, "filesystem", "store path uses a Windows filesystem namespace alias");
+    const relative = path.relative(rootDir, dir);
+    if (isPathRelativeEscape(relative)) {
+        throw new FsSafeError("outside-workspace", "file path escapes store root");
+    }
+    fs.mkdirSync(recursiveMkdirPath(pathForWindowsFilesystem(rootDir)), { recursive: true, mode: params.mode });
+    const receipts = [observeStoreDirectory({
+            dir: rootDir,
+            messagePrefix: params.messagePrefix,
+            root: true,
+        })];
+    const rootReal = storeDirectoryRealPath(rootDir);
+    receipts[0] = finalizeDirectoryMode({
+        receipts,
+        rootReal,
+        mode: params.mode,
+        messagePrefix: params.messagePrefix,
+    });
+    let current = rootDir;
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        let receipt;
+        try {
+            receipt = observeStoreDirectory({
+                dir: current,
+                messagePrefix: params.messagePrefix,
+                root: false,
+            });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            fs.mkdirSync(pathForWindowsFilesystem(current), { mode: params.mode });
+            receipt = observeStoreDirectory({
+                dir: current,
+                messagePrefix: params.messagePrefix,
+                root: false,
+            });
+        }
+        receipts.push(receipt);
+        receipts[receipts.length - 1] = finalizeDirectoryMode({
+            receipts,
+            rootReal,
+            mode: params.mode,
+            messagePrefix: params.messagePrefix,
+        });
+    }
+    const finalChain = assertReceiptChain(receipts, rootReal, params.messagePrefix);
+    return {
+        dir,
+        realPath: finalChain.finalReal,
+        exactStat: finalChain.finalStat,
+    };
+}
+export function assertSyncStoreDirectoryReceipt(receipt) {
+    try {
+        assertNoWindowsPathAlias(receipt.realPath, "filesystem");
+        const stat = inspectStoreDirectory({
+            dir: receipt.dir,
+            expected: receipt.exactStat,
+            messagePrefix: "store",
+            root: false,
+        });
+        if (stat.dev !== receipt.exactStat.dev || stat.ino !== receipt.exactStat.ino ||
+            storeDirectoryRealPath(receipt.dir) !== receipt.realPath) {
+            throw new FsSafeError("path-mismatch", "store directory changed during write");
+        }
+    }
+    catch (error) {
+        if (error instanceof FsSafeError && error.code === "path-mismatch" &&
+            error.message !== "store directory changed during write") {
+            throw new FsSafeError("path-mismatch", "store directory changed during write", {
+                cause: error,
+            });
+        }
+        throw error;
+    }
+}

package/dist/file-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-store.d.ts","sourceRoot":"","sources":["../src/file-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM5C,OAAO,EAA4B,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAQnE,OAAO,EAAmB,KAAK,oBAAoB,EAAE,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAItG,OAAO,EAAQ,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,CACH,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtG,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnG,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/F,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxF,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,qBAAqB,GAAG;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACtF,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,IAAI,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/F,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC;IAChG,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACpG,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,qBAAqB,GAAG;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,MAAM,CAAC;CACX,CAAC;AAgGF,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAiN9D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAwEtE"}
+{"version":3,"file":"file-store.d.ts","sourceRoot":"","sources":["../src/file-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAM5C,OAAO,EAA4B,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC7F,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAQnE,OAAO,EAAmB,KAAK,oBAAoB,EAAE,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAItG,OAAO,EAAQ,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,IAAI,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAUpG,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,eAAe,GAAG;IAAE,QAAQ,CAAC,EAAE,cAAc,CAAA;CAAE,CAAC;AAEnF,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,CACH,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtG,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnG,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5E,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChF,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/F,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxF,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,GAAG,UAAU,EACzB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,qBAAqB,GAAG;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACtF,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,GAAG,IAAI,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAC/F,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC;IAChG,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAAC;IACpG,SAAS,CACP,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,qBAAqB,GAAG;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAC9D,MAAM,CAAC;CACX,CAAC;AAqEF,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,CAoN9D;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CA2EtE"}

package/dist/file-store.js

@@ -15,9 +15,10 @@ import { isNotFoundPathError } from "./path.js";
 import { throwFsSafeReadError } from "./root-errors.js";
 import { root } from "./root.js";
 import { DEFAULT_ROOT_MAX_BYTES } from "./root-impl.js";
-import { readRegularFile } from "./regular-file.js";
 import { matchRootFileOpenFailure, openRootFileSync } from "./root-file.js";
 import { writeSecretFileAtomic } from "./secret-file.js";
+import { assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
+import { readFileStoreCopySource } from "./file-store-copy-source.js";
 function isNotFound(error) {
     return error instanceof FsSafeError ? error.code === "not-found" : isNotFoundPathError(error);
 }
@@ -49,34 +50,10 @@ function handleSyncStoreReadOpenFailure(opened) {
         },
     });
 }
-async function readFileStoreCopySource(params) {
-    const sourceStat = syncFs.lstatSync(params.sourcePath);
-    if (sourceStat.isSymbolicLink() || !sourceStat.isFile()) {
-        throw new FsSafeError("not-file", "source path is not a file");
-    }
-    assertFileStoreMaxBytes(sourceStat.size, params.maxBytes);
-    try {
-        return (await readRegularFile({ filePath: params.sourcePath, maxBytes: params.maxBytes }))
-            .buffer;
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        if (message.includes("regular file") || message.includes("not a regular file")) {
-            throw new FsSafeError("not-file", "source path is not a file", {
-                cause: error instanceof Error ? error : undefined,
-            });
-        }
-        if (params.maxBytes !== undefined && message.includes(`exceeds ${params.maxBytes} bytes`)) {
-            throw new FsSafeError("too-large", `file exceeds maximum size of ${params.maxBytes} bytes`, {
-                cause: error instanceof Error ? error : undefined,
-            });
-        }
-        throw error;
-    }
-}
 async function copyIntoRoot(params) {
     const relativePath = assertRelativePath(params.relativePath);
     const destination = resolveStorePath(params.rootDir, relativePath);
+    assertNoWindowsPathAlias(params.sourcePath, "filesystem", "source path uses a Windows filesystem namespace alias");
     const sourceStat = syncFs.lstatSync(params.sourcePath);
     if (sourceStat.isSymbolicLink() || !sourceStat.isFile()) {
         throw new FsSafeError("not-file", "source path is not a file");
@@ -98,7 +75,10 @@ async function copyIntoRoot(params) {
     return destination;
 }
 export function fileStore(options) {
-    const rootDir = path.resolve(options.rootDir);
+    const rootDirInput = options.rootDir;
+    assertNoWindowsPathAlias(rootDirInput, "filesystem", "store root uses a Windows filesystem namespace alias");
+    const rootDir = resolvePathPreservingWindowsRoot(rootDirInput);
+    assertNoWindowsPathAlias(rootDir, "filesystem", "store root uses a Windows filesystem namespace alias");
     const privateMode = options.private ?? false;
     const dirMode = options.dirMode ?? 0o700;
     const mode = options.mode ?? 0o600;
@@ -284,7 +264,10 @@ export function fileStore(options) {
     };
 }
 export function fileStoreSync(options) {
-    const rootDir = path.resolve(options.rootDir);
+    const rootDirInput = options.rootDir;
+    assertNoWindowsPathAlias(rootDirInput, "filesystem", "store root uses a Windows filesystem namespace alias");
+    const rootDir = resolvePathPreservingWindowsRoot(rootDirInput);
+    assertNoWindowsPathAlias(rootDir, "filesystem", "store root uses a Windows filesystem namespace alias");
     const privateMode = options.private ?? false;
     const dirMode = options.dirMode ?? 0o700;
     const mode = options.mode ?? 0o600;

package/dist/filename.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filename.d.ts","sourceRoot":"","sources":["../src/filename.ts"],"names":[],"mappings":"AAwBA,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAexE;AAkBD,yFAAyF;AACzF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CA8BT;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAqBxF"}
+{"version":3,"file":"filename.d.ts","sourceRoot":"","sources":["../src/filename.ts"],"names":[],"mappings":"AA0BA,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAexE;AA+CD,yFAAyF;AACzF,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CA8BT;AAiCD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAMxF"}