@openclaw/fs-safe 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+## 0.2.3 - 2026-05-14
+
+### Fixes
+
+- Classify broad Windows ACL identities such as Anonymous Logon, Guests, Interactive, Local, and Network as world-equivalent so writable paths are not downgraded to group-writable findings.
+
 ## 0.2.2 - 2026-05-11
 
 ### Fixes

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AA+CF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAQT;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAOf;AAuID,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAyBvF;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAY1E;AAoBD,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,GACxD,OAAO,CAAC,iBAAiB,CAAC,CA+B5B;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAM1E;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B,MAAM,CAaR;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmB7D"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAyCF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAQT;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAOf;AAuID,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAyBvF;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAY1E;AAoBD,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAA;CAAE,GACxD,OAAO,CAAC,iBAAiB,CAAC,CA+B5B;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAM1E;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B,MAAM,CAaR;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmB7D"}

package/dist/permissions.js

@@ -6,13 +6,7 @@ import { promisify } from "node:util";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
 const execFileAsync = promisify(execFile);
 const INHERIT_FLAGS = new Set(["I", "OI", "CI", "IO", "NP"]);
-const WORLD_PRINCIPALS = new Set([
-    "everyone",
-    "users",
-    "builtin\\users",
-    "authenticated users",
-    "nt authority\\authenticated users",
-]);
+const WORLD_PRINCIPALS = new Set(["everyone", "users", "builtin\\users", "authenticated users", "nt authority\\authenticated users", "anonymous logon", "nt authority\\anonymous logon", "guests", "builtin\\guests", "interactive", "nt authority\\interactive", "network", "nt authority\\network", "local"]);
 const TRUSTED_BASE = new Set([
     "nt authority\\system",
     "system",
@@ -31,7 +25,7 @@ const TRUSTED_SIDS = new Set([
     "s-1-5-32-544",
     "s-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
 ]);
-const WORLD_SIDS = new Set(["s-1-1-0", "s-1-5-11", "s-1-5-32-545"]);
+const WORLD_SIDS = new Set(["s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7", "s-1-5-32-546", "s-1-5-4", "s-1-2-0", "s-1-5-2"]);
 const STATUS_PREFIXES = [
     "successfully processed",
     "processed",

package/dist/private-file-store.d.ts

@@ -1,18 +1,16 @@
-import { type FileStore } from "./file-store.js";
-export type PrivateStateStoreOptions = {
+export type PrivateFileStore = {
     rootDir: string;
-};
-export type PrivateStateStore = Omit<FileStore, "readText" | "readJson" | "writeText" | "writeJson"> & {
+    path(relativePath: string): string;
     readText(relativePath: string, options?: {
         maxBytes?: number;
     }): Promise<string | null>;
     readJson<T = unknown>(relativePath: string, options?: {
         maxBytes?: number;
     }): Promise<T | null>;
-    writeText(relativePath: string, content: string | Uint8Array): Promise<string>;
+    writeText(relativePath: string, content: string | Uint8Array): Promise<void>;
     writeJson(relativePath: string, value: unknown, options?: {
         trailingNewline?: boolean;
-    }): Promise<string>;
+    }): Promise<void>;
 };
 export declare function writePrivateTextAtomic(params: {
     rootDir: string;
@@ -56,5 +54,5 @@ export declare function writePrivateJsonAtomicSync(params: {
     value: unknown;
     trailingNewline?: boolean;
 }): void;
-export declare function privateStateStore(options: PrivateStateStoreOptions): PrivateStateStore;
+export declare function privateFileStore(rootDir: string): PrivateFileStore;
 //# sourceMappingURL=private-file-store.d.ts.map

package/dist/private-file-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-file-store.d.ts","sourceRoot":"","sources":["../src/private-file-store.ts"],"names":[],"mappings":"AAIA,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAM5D,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC,GAAG;IACrG,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChG,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3G,CAAC;AAgBF,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBzB;AAoBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,GAAG,IAAI,CAiBhB;AAED,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGpB;AAED,wBAAgB,mBAAmB,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,CAAC,GAAG,IAAI,CAGX;AAoCD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,IAAI,CA4CP;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,IAAI,CAOP;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,iBAAiB,CA2CtF"}
+{"version":3,"file":"private-file-store.d.ts","sourceRoot":"","sources":["../src/private-file-store.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChG,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzG,CAAC;AAgBF,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiBzB;AAoBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,GAAG,IAAI,CAiBhB;AAED,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAGpB;AAED,wBAAgB,mBAAmB,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,CAAC,GAAG,IAAI,CAGX;AAoCD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,UAAU,CAAC;CAC9B,GAAG,IAAI,CA4CP;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,IAAI,CAOP;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAiClE"}

package/dist/private-file-store.js

@@ -2,11 +2,10 @@ import { randomUUID } from "node:crypto";
 import path from "node:path";
 import fs from "node:fs";
 import { FsSafeError } from "./errors.js";
-import { fileStore } from "./file-store.js";
 import { isPathInside } from "./path.js";
 import { readRegularFileSync } from "./regular-file.js";
 import { root } from "./root.js";
-import { writeSecretFileAtomic } from "./secret-file.js";
+import { writePrivateSecretFileAtomic } from "./secret-file.js";
 function resolvePrivateStorePath(rootDir, relativePath) {
     const root = path.resolve(rootDir);
     const raw = relativePath.trim();
@@ -21,7 +20,7 @@ function resolvePrivateStorePath(rootDir, relativePath) {
     return resolved;
 }
 export async function writePrivateTextAtomic(params) {
-    await writeSecretFileAtomic(params);
+    await writePrivateSecretFileAtomic(params);
 }
 export async function readPrivateText(params) {
     const rootDir = path.resolve(params.rootDir);
@@ -173,7 +172,7 @@ export function writePrivateTextAtomicSync(params) {
 }
 export async function writePrivateJsonAtomic(params) {
     const json = JSON.stringify(params.value, null, 2);
-    await writeSecretFileAtomic({
+    await writePrivateSecretFileAtomic({
         rootDir: params.rootDir,
         filePath: params.filePath,
         content: params.trailingNewline && !json.endsWith("\n") ? `${json}\n` : json,
@@ -187,47 +186,35 @@ export function writePrivateJsonAtomicSync(params) {
         content: params.trailingNewline && !json.endsWith("\n") ? `${json}\n` : json,
     });
 }
-export function privateStateStore(options) {
-    const rootDir = path.resolve(options.rootDir);
-    const store = fileStore({ rootDir, private: true });
+export function privateFileStore(rootDir) {
+    const root = path.resolve(rootDir);
     return {
-        ...store,
-        rootDir,
-        path: (relativePath) => resolvePrivateStorePath(rootDir, relativePath),
-        readText: async (relativePath, options) => {
-            const safePath = resolvePrivateStorePath(rootDir, relativePath);
-            return await readPrivateText({
-                rootDir,
-                filePath: safePath,
-                maxBytes: options?.maxBytes,
-            });
-        },
-        readJson: async (relativePath, options) => {
-            const safePath = resolvePrivateStorePath(rootDir, relativePath);
-            return await readPrivateJson({
-                rootDir,
-                filePath: safePath,
-                maxBytes: options?.maxBytes,
-            });
-        },
+        rootDir: root,
+        path: (relativePath) => resolvePrivateStorePath(root, relativePath),
+        readText: async (relativePath, options) => await readPrivateText({
+            rootDir: root,
+            filePath: resolvePrivateStorePath(root, relativePath),
+            maxBytes: options?.maxBytes,
+        }),
+        readJson: async (relativePath, options) => await readPrivateJson({
+            rootDir: root,
+            filePath: resolvePrivateStorePath(root, relativePath),
+            maxBytes: options?.maxBytes,
+        }),
         writeText: async (relativePath, content) => {
-            const safePath = resolvePrivateStorePath(rootDir, relativePath);
             await writePrivateTextAtomic({
-                rootDir,
-                filePath: safePath,
+                rootDir: root,
+                filePath: resolvePrivateStorePath(root, relativePath),
                 content,
             });
-            return safePath;
         },
         writeJson: async (relativePath, value, options) => {
-            const safePath = resolvePrivateStorePath(rootDir, relativePath);
             await writePrivateJsonAtomic({
-                rootDir,
-                filePath: safePath,
+                rootDir: root,
+                filePath: resolvePrivateStorePath(root, relativePath),
                 value,
                 trailingNewline: options?.trailingNewline,
             });
-            return safePath;
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/fs-safe",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Capability-style filesystem roots for Node.js apps that handle untrusted relative paths.",
   "license": "MIT",
   "repository": {
@@ -105,7 +105,7 @@
     "prepack": "node scripts/prepack-build.mjs",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
-    "test:security": "vitest run test/fs-safe.test.ts test/openclaw-read-bypass-parity.test.ts test/openclaw-write-bypass-parity.test.ts test/additional-bypass-parity.test.ts test/adversarial-boundary-payloads.test.ts",
+    "test:security": "vitest run test/fs-safe.test.ts test/read-boundary-bypass.test.ts test/write-boundary-bypass.test.ts test/additional-boundary-bypass.test.ts test/adversarial-boundary-payloads.test.ts",
     "check": "pnpm lint:file-size && pnpm lint:fs-boundary && pnpm build && pnpm test",
     "docs:site": "node scripts/build-docs-site.mjs"
   },

package/dist/archive-utils.d.ts

@@ -1,3 +0,0 @@
-export declare function withTimeout<T>(promise: Promise<T>, timeoutMs: number, label: string): Promise<T>;
-export declare function fileExists(filePath: string): Promise<boolean>;
-//# sourceMappingURL=archive-utils.d.ts.map

package/dist/archive-utils.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"archive-utils.d.ts","sourceRoot":"","sources":["../src/archive-utils.ts"],"names":[],"mappings":"AAEA,wBAAsB,WAAW,CAAC,CAAC,EACjC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnE"}

package/dist/archive-utils.js

@@ -1,26 +0,0 @@
-import fs from "node:fs/promises";
-export async function withTimeout(promise, timeoutMs, label) {
-    let timeoutId;
-    try {
-        return await Promise.race([
-            promise,
-            new Promise((_, reject) => {
-                timeoutId = setTimeout(() => reject(new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs);
-            }),
-        ]);
-    }
-    finally {
-        if (timeoutId) {
-            clearTimeout(timeoutId);
-        }
-    }
-}
-export async function fileExists(filePath) {
-    try {
-        await fs.stat(filePath);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}

package/dist/boundary-file-read.d.ts

@@ -1,44 +0,0 @@
-import fs from "node:fs";
-import type { PathAliasPolicy } from "./path-alias-guards.js";
-import { type SafeOpenSyncAllowedType, type SafeOpenSyncFailureReason } from "./safe-open-sync.js";
-type BoundaryReadFs = Pick<typeof fs, "closeSync" | "constants" | "fstatSync" | "lstatSync" | "openSync" | "readFileSync" | "realpathSync">;
-export type BoundaryFileOpenFailureReason = SafeOpenSyncFailureReason | "validation";
-export type BoundaryFileOpenResult = {
-    ok: true;
-    path: string;
-    fd: number;
-    stat: fs.Stats;
-    rootRealPath: string;
-} | {
-    ok: false;
-    reason: BoundaryFileOpenFailureReason;
-    error?: unknown;
-};
-export type BoundaryFileOpenFailure = Extract<BoundaryFileOpenResult, {
-    ok: false;
-}>;
-export type OpenBoundaryFileSyncParams = {
-    absolutePath: string;
-    rootPath: string;
-    boundaryLabel: string;
-    rootRealPath?: string;
-    maxBytes?: number;
-    rejectHardlinks?: boolean;
-    allowedType?: SafeOpenSyncAllowedType;
-    skipLexicalRootCheck?: boolean;
-    ioFs?: BoundaryReadFs;
-};
-export type OpenBoundaryFileParams = OpenBoundaryFileSyncParams & {
-    aliasPolicy?: PathAliasPolicy;
-};
-export declare function canUseBoundaryFileOpen(ioFs: typeof fs): boolean;
-export declare function openBoundaryFileSync(params: OpenBoundaryFileSyncParams): BoundaryFileOpenResult;
-export declare function matchBoundaryFileOpenFailure<T>(failure: BoundaryFileOpenFailure, handlers: {
-    path?: (failure: BoundaryFileOpenFailure) => T;
-    validation?: (failure: BoundaryFileOpenFailure) => T;
-    io?: (failure: BoundaryFileOpenFailure) => T;
-    fallback: (failure: BoundaryFileOpenFailure) => T;
-}): T;
-export declare function openBoundaryFile(params: OpenBoundaryFileParams): Promise<BoundaryFileOpenResult>;
-export {};
-//# sourceMappingURL=boundary-file-read.d.ts.map

package/dist/boundary-file-read.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"boundary-file-read.d.ts","sourceRoot":"","sources":["../src/boundary-file-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAE7B,KAAK,cAAc,GAAG,IAAI,CACxB,OAAO,EAAE,EACP,WAAW,GACX,WAAW,GACX,WAAW,GACX,WAAW,GACX,UAAU,GACV,cAAc,GACd,cAAc,CACjB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,GAAG,YAAY,CAAC;AAErF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,6BAA6B,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,EAAE;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAErF,MAAM,MAAM,0BAA0B,GAAG;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,GAAG;IAChE,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B,CAAC;AAQF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAW/D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,GAAG,sBAAsB,CAuB/F;AAED,wBAAgB,4BAA4B,CAAC,CAAC,EAC5C,OAAO,EAAE,uBAAuB,EAChC,QAAQ,EAAE;IACR,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,CAAC,CAAC;IACrD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,CAAC,CAAC;IAC7C,QAAQ,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,CAAC,CAAC;CACnD,GACA,CAAC,CAUH;AAoDD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAsBjC"}

package/dist/boundary-file-read.js

@@ -1,129 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { resolveBoundaryPath, resolveBoundaryPathSync, } from "./boundary-path.js";
-import { openVerifiedFileSync, } from "./safe-open-sync.js";
-export function canUseBoundaryFileOpen(ioFs) {
-    return (typeof ioFs.openSync === "function" &&
-        typeof ioFs.closeSync === "function" &&
-        typeof ioFs.fstatSync === "function" &&
-        typeof ioFs.lstatSync === "function" &&
-        typeof ioFs.realpathSync === "function" &&
-        typeof ioFs.readFileSync === "function" &&
-        typeof ioFs.constants === "object" &&
-        ioFs.constants !== null);
-}
-export function openBoundaryFileSync(params) {
-    const ioFs = params.ioFs ?? fs;
-    const resolved = resolveBoundaryFilePathGeneric({
-        absolutePath: params.absolutePath,
-        resolve: (absolutePath) => resolveBoundaryPathSync({
-            absolutePath,
-            rootPath: params.rootPath,
-            rootCanonicalPath: params.rootRealPath,
-            boundaryLabel: params.boundaryLabel,
-            skipLexicalRootCheck: params.skipLexicalRootCheck,
-        }),
-    });
-    if (resolved instanceof Promise) {
-        return toBoundaryValidationError(new Error("Unexpected async boundary resolution"));
-    }
-    return finalizeBoundaryFileOpen({
-        resolved,
-        maxBytes: params.maxBytes,
-        rejectHardlinks: params.rejectHardlinks,
-        allowedType: params.allowedType,
-        ioFs,
-    });
-}
-export function matchBoundaryFileOpenFailure(failure, handlers) {
-    switch (failure.reason) {
-        case "path":
-            return handlers.path ? handlers.path(failure) : handlers.fallback(failure);
-        case "validation":
-            return handlers.validation ? handlers.validation(failure) : handlers.fallback(failure);
-        case "io":
-            return handlers.io ? handlers.io(failure) : handlers.fallback(failure);
-    }
-    return handlers.fallback(failure);
-}
-function openBoundaryFileResolved(params) {
-    const opened = openVerifiedFileSync({
-        filePath: params.absolutePath,
-        resolvedPath: params.resolvedPath,
-        rejectHardlinks: params.rejectHardlinks ?? true,
-        maxBytes: params.maxBytes,
-        allowedType: params.allowedType,
-        ioFs: params.ioFs,
-    });
-    if (!opened.ok) {
-        return opened;
-    }
-    return {
-        ok: true,
-        path: opened.path,
-        fd: opened.fd,
-        stat: opened.stat,
-        rootRealPath: params.rootRealPath,
-    };
-}
-function finalizeBoundaryFileOpen(params) {
-    if ("ok" in params.resolved) {
-        return params.resolved;
-    }
-    return openBoundaryFileResolved({
-        absolutePath: params.resolved.absolutePath,
-        resolvedPath: params.resolved.resolvedPath,
-        rootRealPath: params.resolved.rootRealPath,
-        maxBytes: params.maxBytes,
-        rejectHardlinks: params.rejectHardlinks,
-        allowedType: params.allowedType,
-        ioFs: params.ioFs,
-    });
-}
-export async function openBoundaryFile(params) {
-    const ioFs = params.ioFs ?? fs;
-    const maybeResolved = resolveBoundaryFilePathGeneric({
-        absolutePath: params.absolutePath,
-        resolve: (absolutePath) => resolveBoundaryPath({
-            absolutePath,
-            rootPath: params.rootPath,
-            rootCanonicalPath: params.rootRealPath,
-            boundaryLabel: params.boundaryLabel,
-            policy: params.aliasPolicy,
-            skipLexicalRootCheck: params.skipLexicalRootCheck,
-        }),
-    });
-    const resolved = maybeResolved instanceof Promise ? await maybeResolved : maybeResolved;
-    return finalizeBoundaryFileOpen({
-        resolved,
-        maxBytes: params.maxBytes,
-        rejectHardlinks: params.rejectHardlinks,
-        allowedType: params.allowedType,
-        ioFs,
-    });
-}
-function toBoundaryValidationError(error) {
-    return { ok: false, reason: "validation", error };
-}
-function mapResolvedBoundaryPath(absolutePath, resolved) {
-    return {
-        absolutePath,
-        resolvedPath: resolved.canonicalPath,
-        rootRealPath: resolved.rootCanonicalPath,
-    };
-}
-function resolveBoundaryFilePathGeneric(params) {
-    const absolutePath = path.resolve(params.absolutePath);
-    try {
-        const resolved = params.resolve(absolutePath);
-        if (resolved instanceof Promise) {
-            return resolved
-                .then((value) => mapResolvedBoundaryPath(absolutePath, value))
-                .catch((error) => toBoundaryValidationError(error));
-        }
-        return mapResolvedBoundaryPath(absolutePath, resolved);
-    }
-    catch (error) {
-        return toBoundaryValidationError(error);
-    }
-}

package/dist/boundary-path.d.ts

@@ -1,39 +0,0 @@
-type BoundaryPathIntent = "read" | "write" | "create" | "delete" | "stat";
-export type BoundaryPathAliasPolicy = {
-    allowFinalSymlinkForUnlink?: boolean;
-    allowFinalHardlinkForUnlink?: boolean;
-};
-export declare const BOUNDARY_PATH_ALIAS_POLICIES: {
-    readonly strict: Readonly<{
-        allowFinalSymlinkForUnlink: false;
-        allowFinalHardlinkForUnlink: false;
-    }>;
-    readonly unlinkTarget: Readonly<{
-        allowFinalSymlinkForUnlink: true;
-        allowFinalHardlinkForUnlink: true;
-    }>;
-};
-type ResolveBoundaryPathParams = {
-    absolutePath: string;
-    rootPath: string;
-    boundaryLabel: string;
-    intent?: BoundaryPathIntent;
-    policy?: BoundaryPathAliasPolicy;
-    skipLexicalRootCheck?: boolean;
-    rootCanonicalPath?: string;
-};
-type ResolvedBoundaryPathKind = "missing" | "file" | "directory" | "symlink" | "other";
-export type ResolvedBoundaryPath = {
-    absolutePath: string;
-    canonicalPath: string;
-    rootPath: string;
-    rootCanonicalPath: string;
-    relativePath: string;
-    exists: boolean;
-    kind: ResolvedBoundaryPathKind;
-};
-export declare function resolveBoundaryPath(params: ResolveBoundaryPathParams): Promise<ResolvedBoundaryPath>;
-export declare function resolveBoundaryPathSync(params: ResolveBoundaryPathParams): ResolvedBoundaryPath;
-export declare function resolvePathViaExistingAncestorSync(targetPath: string): string;
-export {};
-//# sourceMappingURL=boundary-path.d.ts.map

package/dist/boundary-path.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"boundary-path.d.ts","sourceRoot":"","sources":["../src/boundary-path.ts"],"names":[],"mappings":"AAMA,KAAK,kBAAkB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG;IACpC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,eAAO,MAAM,4BAA4B;;;;;;;;;CAS/B,CAAC;AAEX,KAAK,yBAAyB,GAAG;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,MAAM,CAAC,EAAE,uBAAuB,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,wBAAwB,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEvF,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,wBAAwB,CAAC;CAChC,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,oBAAoB,CAAC,CA+B/B;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,yBAAyB,GAAG,oBAAoB,CA+B/F;AAmkBD,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA6B7E"}