@openclaw/fs-safe 0.14.0 → 0.16.0

package/dist/native-policy-parent-windows.js

@@ -0,0 +1,209 @@
+import fsSync, {} from "node:fs";
+import path from "node:path";
+import { assertDirectoryIdentitySync, inspectDirectoryIdentitySync, } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { openNativeParentAdmission } from "./native-parent-admission.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { inspectNativeDirectoryObservation } from "./native-directory-observation.js";
+import { createPathSegmentRoute, joinPathSegmentRoute } from "./path-segment-route.js";
+import { isSymlinkOpenError } from "./path.js";
+import { checkedMutationDirectory } from "./pinned-mutation-observation.js";
+import { canReuseParentWithMutationAssertion } from "./root-write-lock-binding.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { createSuppressedError } from "./suppressed-error.js";
+function assertParentCurrent(parent) {
+    const current = inspectFileIdentitySync(() => fsSync.fstatSync(parent.fd, { bigint: true }), parent.guard.stat);
+    assertDirectoryIdentitySync(parent.guard.dir, {
+        dev: parent.guard.stat.dev,
+        ino: parent.guard.stat.ino,
+        realPath: parent.guard.realPath,
+    });
+    return current;
+}
+function closeAfterFailure(closeFd, fd, failure, report = false) {
+    if (fd === undefined)
+        return;
+    try {
+        closeFd(fd);
+    }
+    catch (error) {
+        if (report)
+            throw failure
+                ? createSuppressedError(error, failure.error, "native parent admission and close failed")
+                : error;
+    }
+}
+export async function capturePolicyAwareWindowsParent(binding, params, rootAdmission) {
+    const closeFd = captureNativeFdClose(binding);
+    let session;
+    function parentObservation(fd, guard) {
+        return checkedMutationDirectory(guard.dir, guard.realPath, guard.stat, typeof binding.observeDirectory === "function" ? () => {
+            const stat = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), guard.stat);
+            let observed;
+            try {
+                observed = inspectNativeDirectoryObservation(binding, guard.dir, stat);
+            }
+            catch (error) {
+                if (error?.code === "OBSERVATION_UNAVAILABLE")
+                    return undefined;
+                throw error;
+            }
+            return { canonicalPath: observed.realPath,
+                identity: { dev: stat.dev, ino: stat.ino, mode: stat.mode, nlink: stat.nlink } };
+        } : undefined);
+    }
+    async function openParent(fd, parentPath, relativePath) {
+        try {
+            const admitted = await openNativeParentAdmission(binding, {
+                ...rootAdmission,
+                root: { fd },
+                rootPath: parentPath,
+                // Policy fences retain every identity bit even with a legacy numeric root.
+                exactRoot: true,
+            }, relativePath, "native-directory");
+            const guard = { ...admitted.guard, stat: admitted.guard.stat };
+            return { fd: admitted.fd, guard, observation: parentObservation(admitted.fd, guard) };
+        }
+        catch (error) {
+            if (!isSymlinkOpenError(error))
+                throw error;
+            throw new FsSafeError(params.mutationAdmission.rejectParentSymlinks ? "symlink" : "path-mismatch", "native write parent changed during policy admission", { cause: error instanceof Error ? error : undefined });
+        }
+    }
+    async function authorize(targetPath, mutationPath = targetPath, phase = "parent") {
+        const request = Object.freeze({ targetPath, mutationPath, phase });
+        return await (session ? session.authorize(request) : params.mutationAdmission.authorize(request));
+    }
+    // Existing complete parents need one open and one target admission. Exact
+    // parent denies apply only to creation, never to merely using a directory.
+    let complete;
+    try {
+        complete = await openParent(rootAdmission.root.fd, params.rootPath, params.relativeParentPath);
+    }
+    catch (error) {
+        if (error?.code !== "ENOENT" || !params.mkdir)
+            throw error;
+    }
+    if (complete) {
+        try {
+            await authorize(path.join(complete.guard.realPath, params.basename));
+            assertParentCurrent(complete);
+            return complete;
+        }
+        catch (error) {
+            closeAfterFailure(closeFd, complete.fd, { error }, rootAdmission.reportCloseErrors);
+            throw error;
+        }
+    }
+    const segments = params.relativeParentPath.split("/").filter(Boolean);
+    const route = createPathSegmentRoute(segments);
+    const rootStat = inspectDirectoryIdentitySync(params.rootPath, inspectFileIdentitySync(() => fsSync.fstatSync(rootAdmission.root.fd, { bigint: true })));
+    let current = {
+        fd: rootAdmission.root.fd,
+        guard: { dir: params.rootPath, realPath: params.rootPath, stat: rootStat },
+        observation: parentObservation(rootAdmission.root.fd, {
+            dir: params.rootPath, realPath: params.rootPath, stat: rootStat,
+        }),
+    };
+    let ownedFd;
+    let failure;
+    const initialTarget = joinPathSegmentRoute(params.rootPath, route, 0, params.basename);
+    if (canReuseParentWithMutationAssertion(params.assertBeforeMutation, params.rootPath, initialTarget)) {
+        session = params.mutationAdmission?.beginNativeParentWalk?.() ??
+            params.mutationAdmission?.beginSharedParentWalk?.();
+        if (session && session.retainedTargetPath !== initialTarget) {
+            session.dispose();
+            session = undefined;
+        }
+    }
+    try {
+        for (let index = 0; index < segments.length; index += 1) {
+            const segment = segments[index];
+            const parentPath = current.guard.realPath;
+            let child;
+            let createdByMkdir = false;
+            let createReceipt;
+            try {
+                child = await openParent(current.fd, parentPath, segment);
+            }
+            catch (error) {
+                if (error?.code !== "ENOENT")
+                    throw error;
+                // The request admits both the prospective leaf and this missing direct
+                // child. A deeper denial can leave already admitted ancestors intact.
+                const targetPath = session?.retainedTargetPath ??
+                    joinPathSegmentRoute(parentPath, route, index, params.basename);
+                const mutationPath = path.join(parentPath, segment);
+                const request = Object.freeze({ targetPath, mutationPath, phase: "parent-create" });
+                createReceipt = session?.tryAuthorizeAtParent(request, current.observation);
+                if (!createReceipt) {
+                    createReceipt = await authorize(targetPath, mutationPath, "parent-create");
+                    assertParentCurrent(current);
+                }
+                if (params.assertBeforeMutation) {
+                    // Opaque callbacks retain their post-callback descriptor/path fence.
+                    params.assertBeforeMutation();
+                    assertParentCurrent(current);
+                }
+                // Synchronous session admission already ends at the exact parent fence.
+                const mkdirChild = binding.mkdirChildBeneath;
+                if (typeof mkdirChild !== "function") {
+                    throw new FsSafeError("helper-unavailable", "native direct-child parent creation is unavailable");
+                }
+                createdByMkdir = mkdirChild.call(binding, current.fd, segment, 0o777) === true;
+                child = await openParent(current.fd, parentPath, segment);
+            }
+            try {
+                const targetPath = joinPathSegmentRoute(child.guard.realPath, route, index + 1, params.basename);
+                if (session && targetPath !== session.retainedTargetPath) {
+                    session.dispose();
+                    session = undefined;
+                }
+                let evidence;
+                if (session && createdByMkdir && createReceipt) {
+                    try {
+                        evidence = Object.freeze({
+                            admission: createReceipt,
+                            parent: parentObservation(current.fd, { ...current.guard,
+                                stat: inspectFileIdentitySync(() => fsSync.fstatSync(current.fd, { bigint: true }), current.guard.stat),
+                            }),
+                            child: child.observation,
+                        });
+                    }
+                    catch {
+                        // Incomplete optional evidence returns to ordered admission below.
+                    }
+                }
+                // Advancement refreshes both named directories after all Root/policy
+                // observations; these receipts supply expectations, not cached authority.
+                const advanced = evidence && session.advanceCreatedDirectory(evidence);
+                if (!advanced) {
+                    await authorize(targetPath);
+                    assertParentCurrent(child);
+                }
+            }
+            catch (error) {
+                closeAfterFailure(closeFd, child.fd, { error }, rootAdmission.reportCloseErrors);
+                throw error;
+            }
+            const previousFd = ownedFd;
+            current = child;
+            ownedFd = child.fd;
+            if (previousFd !== undefined)
+                closeFd(previousFd);
+        }
+        if (ownedFd === undefined) {
+            throw new FsSafeError("path-mismatch", "native write parent admission did not complete");
+        }
+        ownedFd = undefined;
+        return current;
+    }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
+    finally {
+        session?.dispose();
+        closeAfterFailure(closeFd, ownedFd, failure, rootAdmission.reportCloseErrors);
+    }
+}

package/dist/native-rename-outcome.d.ts

@@ -0,0 +1,4 @@
+export declare const NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH = "FS_SAFE_INTERNAL_RENAME_SOURCE_IDENTITY_MISMATCH";
+export type NativeRenameFailureOutcome = "uncommitted" | "indeterminate";
+export declare function classifyNativeRenameFailure(error: unknown): NativeRenameFailureOutcome;
+//# sourceMappingURL=native-rename-outcome.d.ts.map

package/dist/native-rename-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-rename-outcome.d.ts","sourceRoot":"","sources":["../src/native-rename-outcome.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sCAAsC,qDACC,CAAC;AAErD,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,eAAe,CAAC;AAEzE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAMtF"}

package/dist/native-rename-outcome.js

@@ -0,0 +1,8 @@
+export const NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH = "FS_SAFE_INTERNAL_RENAME_SOURCE_IDENTITY_MISMATCH";
+export function classifyNativeRenameFailure(error) {
+    const code = error?.code ?? "";
+    // Ordinary errno can follow a committed remote rename whose reply was lost.
+    return code === NATIVE_RENAME_SOURCE_IDENTITY_MISMATCH
+        ? "uncommitted"
+        : "indeterminate";
+}

package/dist/native-staged-file.d.ts

@@ -6,10 +6,11 @@ import type { PinnedWriteInput, PinnedWriteParams } from "./pinned-write.js";
 import type { PublishedFileReceipt, StagedFile, StagedFileCleanupReceipt, StagedFileReceipt } from "./staged-file-types.js";
 export type NativeStagingBinding = NativeBinding & Required<Pick<NativeBinding, "createStagedFile" | "stagedFileMatches" | "removeStagedFile">>;
 export declare function assertNativeStaging(binding: NativeBinding): asserts binding is NativeStagingBinding;
+type StagedPermissionPolicy = "private-creation" | "mode-only";
 declare class NativeStagedFile implements StagedFile {
     #private;
-    constructor(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], portableNames: boolean, publishedMode: number, sync: boolean, assertBeforeMutation?: () => void);
-    static create(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], input: PinnedWriteInput, mode: number, maxBytes?: number, portableNames?: boolean, sync?: boolean, assertBeforeMutation?: () => void): Promise<NativeStagedFile>;
+    constructor(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], portableNames: boolean, publishedMode: number, sync: boolean, assertBeforeMutation?: () => void, name?: string, strictFileSync?: boolean, permissionPolicy?: StagedPermissionPolicy);
+    static create(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], input: PinnedWriteInput, mode: number, maxBytes?: number, portableNames?: boolean, sync?: boolean, assertBeforeMutation?: () => void, exclusiveBasename?: string, strictFileSync?: boolean, permissionPolicy?: StagedPermissionPolicy): Promise<NativeStagedFile>;
     static write(binding: NativeStagingBinding, parentFd: number, closeParentFd: (fd: number) => void, directory: StagedFileReceipt["directory"], params: PinnedWriteParams, parentGuard: AnyAsyncDirectoryGuard): Promise<FileIdentityStat>;
     get receipt(): StagedFileReceipt;
     assertCurrent(): Promise<void>;

package/dist/native-staged-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-staged-file.d.ts","sourceRoot":"","sources":["../src/native-staged-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EAGxB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,QAAQ,CAAC,IAAI,CAC9D,aAAa,EACb,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,CAC9D,CAAC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAWnG;AA6BD,cAAM,gBAAiB,YAAW,UAAU;;IAe1C,YACE,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,oBAAoB,CAAC,EAAE,MAAM,IAAI,EAWlC;IAID,OAAa,MAAM,CACjB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EAEjB,aAAa,UAAO,EACpB,IAAI,UAAO,EACX,oBAAoB,CAAC,EAAE,MAAM,IAAI,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,OAAa,KAAK,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,IAAI,OAAO,IAAI,iBAAiB,CAK/B;IA8FK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnC;IAEK,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,EAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAC7C,OAAO,CAAC,oBAAoB,CAAC,CAyD/B;IAgDK,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAMjD;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3C;CACF;AAED,eAAO,MAAM,iBAAiB,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,UAAU,CAClF,CAAC;AAC1B,eAAO,MAAM,gBAAgB,+BAAyB,CAAC;AAEvD,YAAY,EACV,oBAAoB,EAAE,UAAU,EAAE,wBAAwB,EAAE,wBAAwB,EACpF,qBAAqB,EAAE,iBAAiB,GACzC,MAAM,wBAAwB,CAAC;AAEhC,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACrC,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtB"}
+{"version":3,"file":"native-staged-file.d.ts","sourceRoot":"","sources":["../src/native-staged-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAQlE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG7E,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACV,wBAAwB,EAGxB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAIhC,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,QAAQ,CAAC,IAAI,CAC9D,aAAa,EACb,kBAAkB,GAAG,mBAAmB,GAAG,kBAAkB,CAC9D,CAAC,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAWnG;AAeD,KAAK,sBAAsB,GAAG,kBAAkB,GAAG,WAAW,CAAC;AAE/D,cAAM,gBAAiB,YAAW,UAAU;;IAkB1C,YACE,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,IAAI,SAAiC,EACrC,cAAc,UAAQ,EACtB,gBAAgB,CAAC,EAAE,sBAAsB,EAgB1C;IAID,OAAa,MAAM,CACjB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,MAAM,EAEjB,aAAa,UAAO,EACpB,IAAI,UAAO,EACX,oBAAoB,CAAC,EAAE,MAAM,IAAI,EACjC,iBAAiB,CAAC,EAAE,MAAM,EAC1B,cAAc,UAAQ,EACtB,gBAAgB,CAAC,EAAE,sBAAsB,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAc3B;IAED,OAAa,KAAK,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,EACnC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,EACzC,MAAM,EAAE,iBAAiB,EACzB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA8B3B;IAED,IAAI,OAAO,IAAI,iBAAiB,CAK/B;IAoHK,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnC;IAEK,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,EAC/B,WAAW,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAC7C,OAAO,CAAC,oBAAoB,CAAC,CAqC/B;IAuEK,OAAO,IAAI,OAAO,CAAC,wBAAwB,CAAC,CAMjD;IAEK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3C;CACF;AAED,eAAO,MAAM,iBAAiB,EAAE,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,UAAU,CAClF,CAAC;AAC1B,eAAO,MAAM,gBAAgB,+BAAyB,CAAC;AAEvD,YAAY,EACV,oBAAoB,EAAE,UAAU,EAAE,wBAAwB,EAAE,wBAAwB,EACpF,qBAAqB,EAAE,iBAAiB,GACzC,MAAM,wBAAwB,CAAC;AAEhC,wBAAsB,oBAAoB,CAAC,OAAO,EAAE;IAClD,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACrC,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,UAAU,CAAC,CAatB"}

package/dist/native-staged-file.js

@@ -50,18 +50,22 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
+import { assertDarwinCreationAcl, privateFileMutationAssertion } from "./creation-darwin.js";
+import { assertPrivateCreationFile } from "./creation-file-state.js";
 import { requireNativeBinding } from "./native.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
-import { MutationAuthorityError } from "./mutation-authority.js";
+import { assertSynchronousCallbackResult, MutationAuthorityError } from "./mutation-authority.js";
 import { captureNativeFdClose } from "./native-binding.js";
-import { writeNativeInput } from "./native-operations.js";
+import { writePinnedInput } from "./pinned-write-input.js";
 import { assertNativeCopyCompleted, createNativeCopyFile } from "./copy-file-input.js";
 import { assertStagedDirectoryCurrent, openStagedDirectory } from "./staged-directory.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
+import { classifyNativeRenameFailure } from "./native-rename-outcome.js";
+import { createStagedFileReceipt, stagedFileFailure as failure } from "./staged-file-settlement.js";
 export function assertNativeStaging(binding) {
     if ([
         binding.closeOwnedFd,
@@ -81,17 +85,6 @@ function assertBasename(name, portable) {
     }
 }
 const NOT_PUBLISHED = Object.freeze({ status: "not-published" });
-const UNCOMMITTED_RENAME_ERRORS = new Set([
-    "EACCES", "EBADF", "EBUSY", "EEXIST", "EINVAL", "EISDIR", "ELOOP", "EMLINK",
-    "ENAMETOOLONG", "ENOENT", "ENOSPC", "ENOSYS", "ENOTDIR", "ENOTEMPTY", "ENOTSUP",
-    "EPERM", "EROFS", "ETXTBSY", "EXDEV",
-]);
-function failure(error, details) {
-    const code = error instanceof FsSafeError
-        ? error.code
-        : error?.code === "EEXIST" ? "already-exists" : "helper-failed";
-    return new FsSafeError(code, `staged file ${details.phase} failed`, { cause: error, details });
-}
 class NativeStagedFile {
     #binding;
     #closeFd;
@@ -101,12 +94,17 @@ class NativeStagedFile {
     #portableNames;
     #publishedMode;
     #sync;
+    #strictFileSync;
+    #private;
+    #verifyMode;
     #assertBeforeMutation;
-    #name = `.fs-safe-${randomUUID()}.tmp`;
+    #name;
     #state = { status: "open", publication: NOT_PUBLISHED };
     #receipt;
     #rejectFinalSymlink = false;
-    constructor(binding, parentFd, closeParentFd, directory, portableNames, publishedMode, sync, assertBeforeMutation) {
+    constructor(binding, parentFd, closeParentFd, directory, portableNames, publishedMode, sync, assertBeforeMutation, name = `.fs-safe-${randomUUID()}.tmp`, strictFileSync = false, permissionPolicy) {
+        assertBasename(name, portableNames);
+        this.#name = name;
         this.#closeFd = captureNativeFdClose(binding);
         this.#binding = binding;
         this.#parentFd = parentFd;
@@ -115,16 +113,19 @@ class NativeStagedFile {
         this.#portableNames = portableNames;
         this.#publishedMode = publishedMode;
         this.#sync = sync;
+        this.#strictFileSync = strictFileSync;
+        this.#private = permissionPolicy === "private-creation";
+        this.#verifyMode = permissionPolicy !== undefined;
         this.#assertBeforeMutation = assertBeforeMutation;
     }
     // Public staging supplies a Node parent; pinned writes supply a native parent.
     // The supplied closer owns parentFd even on construction or preparation failure.
     static async create(binding, parentFd, closeParentFd, directory, input, mode, maxBytes, 
     // Public staging uses portable names; existing POSIX writes accept literal names.
-    portableNames = true, sync = true, assertBeforeMutation) {
+    portableNames = true, sync = true, assertBeforeMutation, exclusiveBasename, strictFileSync = false, permissionPolicy) {
         let staged;
         try {
-            staged = new NativeStagedFile(binding, parentFd, closeParentFd, directory, portableNames, mode, sync, assertBeforeMutation);
+            staged = new NativeStagedFile(binding, parentFd, closeParentFd, directory, portableNames, mode, sync, assertBeforeMutation, exclusiveBasename, strictFileSync, permissionPolicy);
         }
         catch (error) {
             try {
@@ -141,15 +142,32 @@ class NativeStagedFile {
     static async write(binding, parentFd, closeParentFd, directory, params, parentGuard) {
         const env_1 = { stack: [], error: void 0, hasError: false };
         try {
+            const exclusive = params.overwrite === false && params.input.kind === "buffer" && params.input.stageBeforePublish === false;
             // This owner never escapes. Only the internal verifier borrows its fd;
             // public descriptor methods remain await-free and cannot race disposal.
-            const staged = __addDisposableResource(env_1, await NativeStagedFile.create(binding, parentFd, closeParentFd, directory, params.input, params.mode, params.maxBytes, false, params.sync, params.assertBeforeMutation), true);
+            const staged = __addDisposableResource(env_1, await NativeStagedFile.create(binding, parentFd, closeParentFd, directory, params.input, params.mode, params.maxBytes, false, params.sync, params.assertBeforeMutation, exclusive ? params.basename : undefined, params.strictFileSync, params.private ? "private-creation" : params.verifyPosixMode === true ? "mode-only" : undefined), true);
             staged.#rejectFinalSymlink = params.rejectFinalSymlink === true;
             if (params.input.kind === "file")
                 await params.input.verifySource();
-            const published = await staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
+            if (exclusive) {
+                staged.#assertCurrent();
+                params.assertBeforeMutation?.();
+                if (staged.#verifyMode)
+                    staged.#assertCurrent();
+            }
+            const published = exclusive
+                ? staged.#completePublication(params.basename, false, params.onPublished)
+                : await staged.publish(params.basename, { overwrite: params.overwrite !== false }, params.onPublished);
             const identity = published.staged.identity;
-            await params.verifyPublished?.(staged.#file(), identity, parentGuard);
+            try {
+                await params.verifyPublished?.(staged.#file(), identity, parentGuard);
+            }
+            catch (error) {
+                if (params.overwrite === false && params.input.kind !== "file" && params.input.stageBeforePublish === true) {
+                    throw failure(error, { phase: "publish", publication: published });
+                }
+                throw error;
+            }
             return { dev: identity.dev, ino: identity.ino };
         }
         catch (e_1) {
@@ -181,13 +199,14 @@ class NativeStagedFile {
         }
         return state.fileFd;
     }
-    #assertNamed(name) {
+    #assertNamed(name, expectedMode) {
         const fd = this.#file();
         const stat = this.#binding.stagedFileMatches(this.#parentFd, name, fd)
             ? fs.fstatSync(fd, { bigint: true }) : undefined;
         if (!stat || stat.nlink !== 1n) {
             throw new FsSafeError("path-mismatch", "staged entry no longer names the exclusive created file");
         }
+        this.#assertPermissions(fd, stat, expectedMode);
         return Number(stat.mode & 4095n);
     }
     #assertCurrent() {
@@ -195,7 +214,17 @@ class NativeStagedFile {
             throw new FsSafeError("helper-failed", "staged file publication has already been attempted");
         }
         assertStagedDirectoryCurrent(this.#directory);
-        this.#assertNamed(this.#name);
+        this.#assertNamed(this.#name, 0o600);
+    }
+    #assertPermissions(fd, stat, expectedMode) {
+        if (this.#private)
+            assertPrivateCreationFile(stat, fd);
+        if (this.#verifyMode && Number(stat.mode & 4095n) !== expectedMode) {
+            throw new FsSafeError("insecure-permissions", "filesystem did not enforce the staged file mode");
+        }
+    }
+    #assertStagePermissions(fd) {
+        this.#assertPermissions(fd, fs.fstatSync(fd, { bigint: true }), 0o600);
     }
     async #prepare(input, maxBytes) {
         try {
@@ -203,44 +232,60 @@ class NativeStagedFile {
             if (!Number.isInteger(mode) || mode < 0 || mode > 0o7777) {
                 throw new FsSafeError("invalid-path", "invalid staged file mode");
             }
+            const fileSignal = input.kind === "file" && this.#verifyMode ? input.signal : undefined;
+            if (input.kind === "file" && this.#verifyMode) {
+                fileSignal?.throwIfAborted();
+                if (input.clone === "always") {
+                    throw new FsSafeError("helper-unavailable", "required cloning cannot verify staged permissions before copying");
+                }
+            }
             assertStagedDirectoryCurrent(this.#directory);
             // The exclusive open performs no fallible post-open checks. Store its fd
             // before every subsequent operation, including the first metadata read.
             const state = this.#open();
+            if (this.#private)
+                assertDarwinCreationAcl(this.#parentFd, "file");
             this.#assertBeforeMutation?.();
-            const copied = input.kind === "file"
+            if (this.#private)
+                assertDarwinCreationAcl(this.#parentFd, "file");
+            // Native copying populates its new file before returning its descriptor.
+            const copied = input.kind === "file" && !this.#verifyMode
                 ? await createNativeCopyFile(this.#binding, input, this.#parentFd, this.#name, maxBytes, false)
                 : undefined;
             state.fileFd = copied?.fd;
             if (state.fileFd === undefined) {
                 this.#assertBeforeMutation?.();
+                if (this.#private)
+                    assertDarwinCreationAcl(this.#parentFd, "file");
                 state.fileFd = this.#binding.createStagedFile(this.#parentFd, this.#name);
             }
             const fd = state.fileFd;
             if (input.kind === "file")
                 assertNativeCopyCompleted(input, copied);
-            this.#assertBeforeMutation?.();
+            const assertBeforeChmod = this.#private
+                ? privateFileMutationAssertion(fd, this.#assertBeforeMutation) : this.#assertBeforeMutation;
+            assertBeforeChmod?.();
             fs.fchmodSync(fd, 0o600);
+            // Some filesystems report successful chmod without enforcing its mode.
+            if (this.#verifyMode)
+                this.#assertStagePermissions(fd);
+            const assertBeforeMutation = this.#verifyMode ? () => {
+                assertSynchronousCallbackResult(this.#assertBeforeMutation?.(), "assertBeforeMutation");
+                fileSignal?.throwIfAborted();
+                this.#assertStagePermissions(fd);
+            } : this.#assertBeforeMutation;
             if (!copied)
-                await writeNativeInput(fd, input, maxBytes, this.#assertBeforeMutation);
-            if (this.#sync)
-                syncFileBestEffortSync(fd);
+                await writePinnedInput(fd, input, maxBytes, assertBeforeMutation);
+            if (this.#verifyMode)
+                this.#assertStagePermissions(fd);
+            if (this.#sync) {
+                if (this.#strictFileSync)
+                    fs.fsyncSync(fd);
+                else
+                    syncFileBestEffortSync(fd);
+            }
             const stat = fs.fstatSync(fd, { bigint: true });
-            this.#receipt = Object.freeze({
-                directory: this.#directory,
-                temporaryBasename: this.#name,
-                identity: Object.freeze({
-                    dev: stat.dev,
-                    ino: stat.ino,
-                    mode: Number(stat.mode & 4095n),
-                    nlink: stat.nlink,
-                    size: stat.size,
-                    uid: Number(stat.uid),
-                    gid: Number(stat.gid),
-                    mtimeNs: stat.mtimeNs,
-                    ctimeNs: stat.ctimeNs,
-                }),
-            });
+            this.#receipt = createStagedFileReceipt(this.#directory, this.#name, stat);
             this.#assertCurrent();
         }
         catch (error) {
@@ -270,6 +315,10 @@ class NativeStagedFile {
             this.#assertCurrent();
             assertFinalSymlinkRejected(path.join(this.#directory.realPath, basename), this.#rejectFinalSymlink);
             this.#assertBeforeMutation?.();
+            if (this.#assertBeforeMutation) {
+                this.#assertCurrent();
+                assertFinalSymlinkRejected(path.join(this.#directory.realPath, basename), this.#rejectFinalSymlink);
+            }
             try {
                 if (overwrite) {
                     this.#binding.renameReplace(this.#parentFd, this.#name, this.#parentFd, basename);
@@ -279,39 +328,13 @@ class NativeStagedFile {
                 }
             }
             catch (error) {
-                // Unknown rename errors can be indeterminate on remote filesystems.
-                if (!UNCOMMITTED_RENAME_ERRORS.has(error?.code ?? "")) {
+                // Only explicit pre-dispatch provenance can rule out a committed rename.
+                if (classifyNativeRenameFailure(error) === "indeterminate") {
                     state.publication = Object.freeze({ status: "indeterminate", basename, overwrite });
                 }
                 throw error;
             }
-            // Commit is recorded synchronously before any post-rename operation.
-            const receipt = Object.freeze({
-                status: "published",
-                staged: this.receipt,
-                basename,
-                overwrite,
-            });
-            state.publication = receipt;
-            onPublished?.(receipt.staged.identity);
-            const stagedMode = this.#assertNamed(basename);
-            assertStagedDirectoryCurrent(this.#directory);
-            // Keep contents private until the published name passes its identity
-            // fence. Mode changes use the owned fd, including for final mode 000.
-            const fd = this.#file();
-            if (this.#publishedMode !== 0o600 || stagedMode !== 0o600)
-                fs.fchmodSync(fd, this.#publishedMode);
-            // With sync enabled, content was synced before rename. A lost chmod leaves staged 0600,
-            // no wider than modes retaining owner rw. Restrictive modes and observed
-            // widening of the stage still need the permission correction made durable.
-            if (this.#sync && ((this.#publishedMode & 0o600) !== 0o600 || (stagedMode & ~this.#publishedMode) !== 0)) {
-                syncFileBestEffortSync(fd);
-            }
-            if (this.#sync)
-                syncFileBestEffortSync(this.#parentFd);
-            this.#assertNamed(basename);
-            assertStagedDirectoryCurrent(this.#directory);
-            return receipt;
+            return this.#completePublication(basename, overwrite, onPublished);
         }
         catch (error) {
             if (error instanceof MutationAuthorityError)
@@ -323,6 +346,32 @@ class NativeStagedFile {
             throw failure(error, { phase: "publish", publication });
         }
     }
+    #completePublication(basename, overwrite, onPublished) {
+        // Record complete content before fallible post-publication verification.
+        const receipt = Object.freeze({ status: "published", staged: this.receipt, basename, overwrite });
+        this.#open().publication = receipt;
+        onPublished?.(receipt.staged.identity);
+        const stagedMode = this.#assertNamed(basename, 0o600);
+        assertStagedDirectoryCurrent(this.#directory);
+        // Keep contents private until the name passes its identity fence. Mode
+        // changes use the owned fd, including for final mode 000.
+        const fd = this.#file();
+        if (this.#publishedMode !== 0o600 || stagedMode !== 0o600)
+            fs.fchmodSync(fd, this.#publishedMode);
+        // Content was synced during preparation. A lost chmod leaves 0600, no wider
+        // than modes retaining owner rw; restrictive modes still need a durable correction.
+        if (this.#sync && ((this.#publishedMode & 0o600) !== 0o600 || (stagedMode & ~this.#publishedMode) !== 0)) {
+            if (this.#strictFileSync)
+                fs.fsyncSync(fd);
+            else
+                syncFileBestEffortSync(fd);
+        }
+        if (this.#sync)
+            syncFileBestEffortSync(this.#parentFd);
+        this.#assertNamed(basename, this.#publishedMode);
+        assertStagedDirectoryCurrent(this.#directory);
+        return receipt;
+    }
     #finalize() {
         if (this.#state.status === "closed") {
             return this.#state;
@@ -395,5 +444,5 @@ export async function stageFileInDirectory(options) {
     const input = { kind: "buffer", data: Buffer.from(options.content) };
     const mode = options.mode ?? 0o600;
     const parent = openStagedDirectory(options.directory);
-    return await createNativeStage(binding, parent.fd, fs.closeSync, parent.receipt, input, mode);
+    return await createNativeStage(binding, parent.fd, fs.closeSync, parent.receipt, input, mode, undefined, true, true, undefined, undefined, false, "mode-only");
 }

package/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAClC,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AAyDF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CA2DrC"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAClC,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AAyDF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CA+DrC"}

package/dist/output.js

@@ -57,6 +57,10 @@ export async function writeExternalFileWithinRoot(options) {
     const requestedTargetPath = options.path;
     assertNoWindowsPathAlias(path.dirname(requestedTargetPath), "filesystem", "output target parent uses a Windows filesystem namespace alias");
     const producerIsolation = options.producerIsolation;
+    const write = options.write;
+    const mode = options.mode;
+    const staging = options.staging;
+    const fallbackFileName = options.fallbackFileName;
     const targetRoot = await root(rootDir);
     if (requestedTargetPath.length === 0) {
         throw new FsSafeError("invalid-path", "target path is required");
@@ -68,11 +72,11 @@ export async function writeExternalFileWithinRoot(options) {
         targetPath: requestedTargetPath,
     });
     assertFileTargetPath(rawTargetPath);
-    const targetPath = sanitizedTargetPath(rawTargetPath, options.fallbackFileName);
+    const targetPath = sanitizedTargetPath(rawTargetPath, fallbackFileName);
     assertNoWindowsPathAlias(targetPath, "filesystem", "output target uses a Windows filesystem namespace alias");
     const finalPath = await targetRoot.resolve(targetPath);
     assertNoWindowsPathAlias(finalPath, "filesystem", "output target uses a Windows filesystem namespace alias");
-    if (options.staging === "sibling") {
+    if (staging === "sibling") {
         const parentPath = path.dirname(targetPath);
         if (parentPath !== ".") {
             await targetRoot.mkdir(parentPath);
@@ -80,23 +84,23 @@ export async function writeExternalFileWithinRoot(options) {
         const siblingFinalPath = await targetRoot.resolve(targetPath);
         const result = await writeExternalFileViaSibling({
             finalPath: siblingFinalPath,
-            write: options.write,
+            write,
             producerIsolation,
-            fallbackFileName: options.fallbackFileName,
+            fallbackFileName,
             maxBytes,
-            mode: options.mode,
+            mode,
         });
         return { path: siblingFinalPath, result };
     }
     const staged = await tempFile({
         prefix: "fs-safe-output",
-        fileName: tempFileNameForTarget(targetPath, options.fallbackFileName),
+        fileName: tempFileNameForTarget(targetPath, fallbackFileName),
     });
     try {
-        const result = await options.write(staged.path);
+        const result = await Function.prototype.call.call(write, options, staged.path);
         await targetRoot.copyIn(targetPath, staged.path, {
             maxBytes,
-            mode: options.mode,
+            mode,
             mkdir: true,
             sourceHardlinks: "reject",
         });

package/dist/owner-dacl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-dacl.d.ts","sourceRoot":"","sources":["../src/owner-dacl.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,yBAAyB,EAAE,CAAC;CACnC,GACD;IACE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAmCvE"}
+{"version":3,"file":"owner-dacl.d.ts","sourceRoot":"","sources":["../src/owner-dacl.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,yBAAyB,EAAE,CAAC;CACnC,GACD;IACE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAmCvE"}