@openclaw/fs-safe 0.2.6 → 0.3.0

package/dist/archive.js

@@ -4,13 +4,16 @@ import path from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
+import { createPipelineTimeoutError, waitForDeadline, withExtractionDeadline, } from "./archive-deadline.js";
+import { writeFileHandleFully } from "./archive-file-io.js";
 import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, assertArchiveEntryCountWithinLimit, createByteBudgetTracker, createExtractBudgetTransform, resolveExtractLimits, } from "./archive-limits.js";
 import { resolveArchiveKind } from "./archive-kind.js";
 import { mergeExtractedTreeIntoDestination, prepareArchiveDestinationDir, prepareArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
 import { createTarEntryPreflightChecker, readTarEntryInfo, } from "./archive-tar.js";
 import { loadZipArchiveWithPreflight } from "./archive-zip-preflight.js";
+import { sameFileIdentity } from "./file-identity.js";
 import { writeSiblingTempFile } from "./sibling-temp.js";
-import { withTimeout } from "./timing.js";
+import { tempFile } from "./temp-target.js";
 export { isWindowsDrivePath, normalizeArchiveEntryPath, resolveArchiveOutputPath, stripArchivePath, validateArchiveEntryPath, } from "./archive-entry.js";
 export { resolveArchiveKind, resolvePackedRootDir } from "./archive-kind.js";
 export { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, DEFAULT_MAX_ARCHIVE_BYTES_ZIP, DEFAULT_MAX_ENTRIES, DEFAULT_MAX_EXTRACTED_BYTES, DEFAULT_MAX_ENTRY_BYTES, } from "./archive-limits.js";
@@ -29,6 +32,85 @@ function isZipSymlinkEntry(entry) {
     return (typeof entry.unixPermissions === "number" &&
         (entry.unixPermissions & ZIP_UNIX_FILE_TYPE_MASK) === ZIP_UNIX_SYMLINK_TYPE);
 }
+function zipEntryFileMode(entry) {
+    if (typeof entry.unixPermissions !== "number") {
+        return undefined;
+    }
+    const mode = entry.unixPermissions & 0o777;
+    return mode === 0 ? undefined : mode;
+}
+async function cleanupStagedArchiveFile(staged) {
+    if (staged) {
+        await staged.cleanup().catch(() => undefined);
+    }
+}
+async function closeFileHandle(handle) {
+    if (handle) {
+        await handle.close().catch(() => undefined);
+    }
+}
+async function stageArchiveFileForExtraction(params) {
+    params.deadline.check();
+    const sourcePath = path.resolve(params.archivePath);
+    const initialStat = await fs.lstat(sourcePath);
+    if (initialStat.isSymbolicLink() || !initialStat.isFile()) {
+        throw new Error(`archive is not a regular file: ${params.archivePath}`);
+    }
+    if (initialStat.size > params.limits.maxArchiveBytes) {
+        throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ARCHIVE_SIZE_EXCEEDS_LIMIT);
+    }
+    const noFollow = process.platform !== "win32" && "O_NOFOLLOW" in fsConstants ? fsConstants.O_NOFOLLOW : 0;
+    const handle = await fs.open(sourcePath, fsConstants.O_RDONLY | noFollow);
+    let staged;
+    let output;
+    try {
+        staged = await tempFile({
+            prefix: "fs-safe-archive-input",
+            fileName: path.basename(sourcePath),
+        });
+        const openedStat = await handle.stat();
+        const pathStat = await fs.lstat(sourcePath);
+        if (!openedStat.isFile() ||
+            pathStat.isSymbolicLink() ||
+            !pathStat.isFile() ||
+            !sameFileIdentity(initialStat, openedStat) ||
+            !sameFileIdentity(pathStat, openedStat)) {
+            throw new Error("archive changed during validation");
+        }
+        output = await fs.open(staged.path, OPEN_WRITE_CREATE_FLAGS, 0o600);
+        const buffer = Buffer.allocUnsafe(64 * 1024);
+        let written = 0;
+        while (true) {
+            params.deadline.check();
+            const { bytesRead } = await handle.read(buffer, 0, buffer.length, null);
+            if (bytesRead === 0) {
+                break;
+            }
+            written += bytesRead;
+            if (written > params.limits.maxArchiveBytes) {
+                throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ARCHIVE_SIZE_EXCEEDS_LIMIT);
+            }
+            await writeFileHandleFully({
+                handle: output,
+                buffer,
+                bytes: bytesRead,
+                deadline: params.deadline,
+            });
+            params.deadline.check();
+        }
+        await output.close();
+        output = undefined;
+        return staged;
+    }
+    catch (err) {
+        await closeFileHandle(output);
+        await cleanupStagedArchiveFile(staged);
+        throw err;
+    }
+    finally {
+        await closeFileHandle(handle);
+    }
+}
 async function readZipEntryStream(entry) {
     if (typeof entry.nodeStream === "function") {
         return entry.nodeStream();
@@ -57,6 +139,7 @@ async function prepareZipOutputPath(params) {
     await prepareArchiveOutputPath(params);
 }
 async function writeZipFileEntry(params) {
+    params.deadline.check();
     params.budget.startEntry();
     const readable = await readZipEntryStream(params.entry);
     const destinationPath = params.outPath;
@@ -67,13 +150,20 @@ async function writeZipFileEntry(params) {
             dir: path.dirname(destinationPath),
             tempPrefix: `.${path.basename(destinationPath)}.fs-safe-archive`,
             chmodDir: false,
+            mode: zipEntryFileMode(params.entry),
             writeTemp: async (tempPath) => {
                 tempHandle = await fs.open(tempPath, OPEN_WRITE_CREATE_FLAGS, 0o666);
                 const writable = tempHandle.createWriteStream();
                 writable.once("close", () => {
                     handleClosedByStream = true;
                 });
-                await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), writable);
+                try {
+                    await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), writable, { signal: params.deadline.signal });
+                }
+                catch (err) {
+                    throw createPipelineTimeoutError(err, params.deadline);
+                }
+                params.deadline.check();
                 if (!handleClosedByStream) {
                     await tempHandle.close().catch(() => undefined);
                     handleClosedByStream = true;
@@ -83,13 +173,6 @@ async function writeZipFileEntry(params) {
             },
             resolveFinalPath: (filePath) => filePath,
         });
-        // Best-effort permission restore for zip entries created on unix.
-        if (typeof params.entry.unixPermissions === "number") {
-            const mode = params.entry.unixPermissions & 0o777;
-            if (mode !== 0) {
-                await fs.chmod(destinationPath, mode).catch(() => undefined);
-            }
-        }
     }
     catch (err) {
         // Failures here happen before the temp has been committed. The destination
@@ -105,57 +188,70 @@ async function writeZipFileEntry(params) {
 }
 async function extractZip(params) {
     const limits = resolveExtractLimits(params.limits);
-    const destinationRealDir = await prepareArchiveDestinationDir(params.destDir);
-    const stat = await fs.stat(params.archivePath);
-    if (stat.size > limits.maxArchiveBytes) {
-        throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ARCHIVE_SIZE_EXCEEDS_LIMIT);
-    }
-    const buffer = await fs.readFile(params.archivePath);
-    const zip = await loadZipArchiveWithPreflight(buffer, limits);
-    const entries = Object.values(zip.files);
-    const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
-    assertArchiveEntryCountWithinLimit(entries.length, limits);
-    const budget = createByteBudgetTracker(limits);
-    await withStagedArchiveDestination({
-        destinationRealDir,
-        run: async (stagingDir) => {
-            const stagingRealDir = await fs.realpath(stagingDir);
-            for (const entry of entries) {
-                const output = resolveZipOutputPath({
-                    entryPath: entry.name,
-                    strip,
-                    destinationDir: stagingRealDir,
-                });
-                if (!output) {
-                    continue;
-                }
-                await prepareZipOutputPath({
-                    destinationDir: stagingRealDir,
-                    destinationRealDir: stagingRealDir,
-                    relPath: output.relPath,
-                    outPath: output.outPath,
-                    originalPath: entry.name,
-                    isDirectory: entry.dir,
-                });
-                if (entry.dir) {
-                    continue;
-                }
-                if (isZipSymlinkEntry(entry)) {
-                    throw new Error(`zip entry is a link: ${entry.name}`);
+    const stagedArchive = await stageArchiveFileForExtraction({
+        archivePath: params.archivePath,
+        limits,
+        deadline: params.deadline,
+    });
+    try {
+        const destinationRealDir = await prepareArchiveDestinationDir(params.destDir);
+        params.deadline.check();
+        const buffer = await fs.readFile(stagedArchive.path, { signal: params.deadline.signal });
+        params.deadline.check();
+        const zip = await waitForDeadline(loadZipArchiveWithPreflight(buffer, limits), params.deadline);
+        params.deadline.check();
+        const entries = Object.values(zip.files);
+        const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
+        assertArchiveEntryCountWithinLimit(entries.length, limits);
+        const budget = createByteBudgetTracker(limits);
+        await withStagedArchiveDestination({
+            destinationRealDir,
+            run: async (stagingDir) => {
+                const stagingRealDir = await fs.realpath(stagingDir);
+                for (const entry of entries) {
+                    params.deadline.check();
+                    const output = resolveZipOutputPath({
+                        entryPath: entry.name,
+                        strip,
+                        destinationDir: stagingRealDir,
+                    });
+                    if (!output) {
+                        continue;
+                    }
+                    await prepareZipOutputPath({
+                        destinationDir: stagingRealDir,
+                        destinationRealDir: stagingRealDir,
+                        relPath: output.relPath,
+                        outPath: output.outPath,
+                        originalPath: entry.name,
+                        isDirectory: entry.dir,
+                    });
+                    if (entry.dir) {
+                        continue;
+                    }
+                    if (isZipSymlinkEntry(entry)) {
+                        throw new Error(`zip entry is a link: ${entry.name}`);
+                    }
+                    await writeZipFileEntry({
+                        entry,
+                        outPath: output.outPath,
+                        budget,
+                        deadline: params.deadline,
+                    });
                 }
-                await writeZipFileEntry({
-                    entry,
-                    outPath: output.outPath,
-                    budget,
+                params.deadline.check();
+                await mergeExtractedTreeIntoDestination({
+                    sourceDir: stagingRealDir,
+                    destinationDir: params.destDir,
+                    destinationRealDir,
                 });
-            }
-            await mergeExtractedTreeIntoDestination({
-                sourceDir: stagingRealDir,
-                destinationDir: params.destDir,
-                destinationRealDir,
-            });
-        },
-    });
+                params.deadline.check();
+            },
+        });
+    }
+    finally {
+        await stagedArchive.cleanup();
+    }
 }
 export async function extractArchive(params) {
     const kind = params.kind ?? resolveArchiveKind(params.archivePath);
@@ -164,62 +260,74 @@ export async function extractArchive(params) {
     }
     const label = kind === "zip" ? "extract zip" : "extract tar";
     if (kind === "tar") {
-        await withTimeout((async () => {
+        await withExtractionDeadline(params.timeoutMs, label, async (deadline) => {
             const tar = await importOptionalTar();
             const limits = resolveExtractLimits(params.limits);
-            const stat = await fs.stat(params.archivePath);
-            if (stat.size > limits.maxArchiveBytes) {
-                throw new ArchiveLimitError(ARCHIVE_LIMIT_ERROR_CODE.ARCHIVE_SIZE_EXCEEDS_LIMIT);
-            }
-            const destinationRealDir = await prepareArchiveDestinationDir(params.destDir);
-            await withStagedArchiveDestination({
-                destinationRealDir,
-                run: async (stagingDir) => {
-                    const checkTarEntrySafety = createTarEntryPreflightChecker({
-                        rootDir: destinationRealDir,
-                        stripComponents: params.stripComponents,
-                        limits,
-                    });
-                    // A canonical cwd is not enough here: tar can still follow
-                    // pre-existing child symlinks in the live destination tree.
-                    // Extract into a private staging dir first, then merge through
-                    // the same safe-open boundary checks used by direct file writes.
-                    await tar.x({
-                        file: params.archivePath,
-                        cwd: stagingDir,
-                        strip: Math.max(0, Math.floor(params.stripComponents ?? 0)),
-                        gzip: params.tarGzip,
-                        preservePaths: false,
-                        strict: true,
-                        onReadEntry(entry) {
-                            try {
-                                checkTarEntrySafety(readTarEntryInfo(entry));
-                            }
-                            catch (err) {
-                                const error = err instanceof Error ? err : new Error(String(err));
-                                // Node's EventEmitter calls listeners with `this` bound to the
-                                // emitter (tar.Unpack), which exposes Parser.abort().
-                                const emitter = this;
-                                emitter.abort?.(error);
-                            }
-                        },
-                    });
-                    await mergeExtractedTreeIntoDestination({
-                        sourceDir: stagingDir,
-                        destinationDir: params.destDir,
-                        destinationRealDir,
-                    });
-                },
+            const stagedArchive = await stageArchiveFileForExtraction({
+                archivePath: params.archivePath,
+                limits,
+                deadline,
             });
-        })(), params.timeoutMs, label);
+            try {
+                const destinationRealDir = await prepareArchiveDestinationDir(params.destDir);
+                await withStagedArchiveDestination({
+                    destinationRealDir,
+                    run: async (stagingDir) => {
+                        deadline.check();
+                        const checkTarEntrySafety = createTarEntryPreflightChecker({
+                            rootDir: destinationRealDir,
+                            stripComponents: params.stripComponents,
+                            limits,
+                        });
+                        // A canonical cwd is not enough here: tar can still follow
+                        // pre-existing child symlinks in the live destination tree.
+                        // Extract into a private staging dir first, then merge through
+                        // the same safe-open boundary checks used by direct file writes.
+                        await tar.x({
+                            file: stagedArchive.path,
+                            cwd: stagingDir,
+                            strip: Math.max(0, Math.floor(params.stripComponents ?? 0)),
+                            gzip: params.tarGzip,
+                            signal: deadline.signal,
+                            preservePaths: false,
+                            strict: true,
+                            onReadEntry(entry) {
+                                try {
+                                    deadline.check();
+                                    checkTarEntrySafety(readTarEntryInfo(entry));
+                                }
+                                catch (err) {
+                                    const error = err instanceof Error ? err : new Error(String(err));
+                                    // Node's EventEmitter calls listeners with `this` bound to the
+                                    // emitter (tar.Unpack), which exposes Parser.abort().
+                                    const emitter = this;
+                                    emitter.abort?.(error);
+                                }
+                            },
+                        });
+                        deadline.check();
+                        await mergeExtractedTreeIntoDestination({
+                            sourceDir: stagingDir,
+                            destinationDir: params.destDir,
+                            destinationRealDir,
+                        });
+                        deadline.check();
+                    },
+                });
+            }
+            finally {
+                await stagedArchive.cleanup();
+            }
+        });
         return;
     }
-    await withTimeout(extractZip({
+    await withExtractionDeadline(params.timeoutMs, label, async (deadline) => extractZip({
         archivePath: params.archivePath,
         destDir: params.destDir,
         stripComponents: params.stripComponents,
         limits: params.limits,
-    }), params.timeoutMs, label);
+        deadline,
+    }));
 }
 async function importOptionalTar() {
     try {

package/dist/deny-mutations.d.ts

@@ -0,0 +1,11 @@
+export type DenyMutationPolicy = {
+    paths?: readonly string[];
+    prefixes?: readonly string[];
+};
+type DenyMutationCheckOptions = {
+    protectAncestors?: boolean;
+};
+export declare function assertMutationNotDenied(filePath: string, policy: DenyMutationPolicy | undefined, options?: DenyMutationCheckOptions): Promise<void>;
+export declare function mergeDenyMutationPolicies(defaultPolicy: DenyMutationPolicy | undefined, callPolicy: DenyMutationPolicy | undefined): DenyMutationPolicy | undefined;
+export {};
+//# sourceMappingURL=deny-mutations.d.ts.map

package/dist/deny-mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-mutations.d.ts","sourceRoot":"","sources":["../src/deny-mutations.ts"],"names":[],"mappings":"AAmDA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAqBF,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,kBAAkB,GAAG,SAAS,EAC7C,UAAU,EAAE,kBAAkB,GAAG,SAAS,GACzC,kBAAkB,GAAG,SAAS,CAWhC"}

package/dist/deny-mutations.js

@@ -0,0 +1,102 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { assertNoNulPathInput, isNotFoundPathError, isPathInside } from "./path.js";
+async function pathExists(filePath) {
+    try {
+        await fs.lstat(filePath);
+        return true;
+    }
+    catch (err) {
+        if (!isNotFoundPathError(err)) {
+            throw err;
+        }
+        return false;
+    }
+}
+async function resolvePathViaExistingAncestor(targetPath) {
+    const normalized = path.resolve(targetPath);
+    let cursor = normalized;
+    const missingSuffix = [];
+    while (path.dirname(cursor) !== cursor && !(await pathExists(cursor))) {
+        missingSuffix.unshift(path.basename(cursor));
+        cursor = path.dirname(cursor);
+    }
+    if (!(await pathExists(cursor))) {
+        return normalized;
+    }
+    try {
+        const resolvedAncestor = path.resolve(await fs.realpath(cursor));
+        return missingSuffix.length === 0
+            ? resolvedAncestor
+            : path.resolve(resolvedAncestor, ...missingSuffix);
+    }
+    catch {
+        return normalized;
+    }
+}
+async function comparablePaths(rawPath) {
+    assertNoNulPathInput(rawPath, "path contains a NUL byte");
+    const resolved = path.resolve(rawPath);
+    return new Set([resolved, await resolvePathViaExistingAncestor(resolved)]);
+}
+function isSamePath(left, right) {
+    return isPathInside(left, right) && isPathInside(right, left);
+}
+function hasPolicyEntries(policy) {
+    return Boolean(policy?.paths?.length || policy?.prefixes?.length);
+}
+function policyPathEntries(entries) {
+    const paths = [];
+    for (const entry of entries ?? []) {
+        if (entry.length === 0) {
+            throw new FsSafeError("invalid-path", "deny mutation paths must be non-empty");
+        }
+        assertNoNulPathInput(entry, "deny mutation path contains a NUL byte");
+        if (!path.isAbsolute(entry)) {
+            throw new FsSafeError("invalid-path", "deny mutation paths must be absolute");
+        }
+        paths.push(entry);
+    }
+    return paths;
+}
+export async function assertMutationNotDenied(filePath, policy, options = {}) {
+    if (!hasPolicyEntries(policy)) {
+        return;
+    }
+    const targetPaths = await comparablePaths(filePath);
+    for (const deniedPath of policyPathEntries(policy.paths)) {
+        const deniedPaths = await comparablePaths(deniedPath);
+        for (const target of targetPaths) {
+            for (const denied of deniedPaths) {
+                if (isSamePath(denied, target) ||
+                    (options.protectAncestors === true && isPathInside(target, denied))) {
+                    throw new FsSafeError("denied-path", "path is denied by denyMutations policy");
+                }
+            }
+        }
+    }
+    for (const deniedPrefix of policyPathEntries(policy.prefixes)) {
+        const deniedPaths = await comparablePaths(deniedPrefix);
+        for (const target of targetPaths) {
+            for (const denied of deniedPaths) {
+                if (isPathInside(denied, target) ||
+                    (options.protectAncestors === true && isPathInside(target, denied))) {
+                    throw new FsSafeError("denied-path", "path is denied by denyMutations policy");
+                }
+            }
+        }
+    }
+}
+export function mergeDenyMutationPolicies(defaultPolicy, callPolicy) {
+    if (!defaultPolicy) {
+        return callPolicy;
+    }
+    if (!callPolicy) {
+        return defaultPolicy;
+    }
+    return {
+        paths: [...(defaultPolicy.paths ?? []), ...(callPolicy.paths ?? [])],
+        prefixes: [...(defaultPolicy.prefixes ?? []), ...(callPolicy.prefixes ?? [])],
+    };
+}

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type FsSafeErrorCode = "already-exists" | "hardlink" | "helper-failed" | "helper-unavailable" | "invalid-path" | "insecure-permissions" | "not-empty" | "not-file" | "not-found" | "not-owned" | "not-removable" | "outside-workspace" | "path-alias" | "path-mismatch" | "permission-unverified" | "symlink" | "timeout" | "too-large" | "unsupported-platform";
+export type FsSafeErrorCode = "already-exists" | "denied-path" | "hardlink" | "helper-failed" | "helper-unavailable" | "invalid-path" | "insecure-permissions" | "not-empty" | "not-file" | "not-found" | "not-owned" | "not-removable" | "outside-workspace" | "path-alias" | "path-mismatch" | "permission-unverified" | "symlink" | "timeout" | "too-large" | "unsupported-platform";
 export type FsSafeErrorCategory = "policy" | "operational";
 export declare function categorizeFsSafeError(code: FsSafeErrorCode): FsSafeErrorCategory;
 export declare class FsSafeError extends Error {

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,UAAU,GACV,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,sBAAsB,GACtB,WAAW,GACX,UAAU,GACV,WAAW,GACX,WAAW,GACX,eAAe,GACf,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,SAAS,GACT,SAAS,GACT,WAAW,GACX,sBAAsB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAU3D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAEhF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;gBAE3B,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAMtF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GACvB,gBAAgB,GAChB,aAAa,GACb,UAAU,GACV,eAAe,GACf,oBAAoB,GACpB,cAAc,GACd,sBAAsB,GACtB,WAAW,GACX,UAAU,GACV,WAAW,GACX,WAAW,GACX,eAAe,GACf,mBAAmB,GACnB,YAAY,GACZ,eAAe,GACf,uBAAuB,GACvB,SAAS,GACT,SAAS,GACT,WAAW,GACX,sBAAsB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAU3D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,CAEhF;AAED,qBAAa,WAAY,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;gBAE3B,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAMtF"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { FsSafeError, categorizeFsSafeError, type FsSafeErrorCategory, type FsSafeErrorCode, } from "./errors.js";
-export { DEFAULT_ROOT_MAX_BYTES, root, type HardlinkPolicy, type OpenResult, type ReadResult, type Root, type RootAppendOptions, type RootCopyOptions, type RootCreateJsonOptions, type RootCreateOptions, type RootDefaults, type RootOpenOptions, type RootOpenWritableOptions, type RootOptions, type RootReadOptions, type RootWriteJsonOptions, type RootWriteOptions, type SymlinkPolicy, type WritableOpenMode, type WritableOpenResult, } from "./root.js";
+export { DEFAULT_ROOT_MAX_BYTES, root, type DenyMutationPolicy, type HardlinkPolicy, type OpenResult, type ReadResult, type Root, type RootAppendOptions, type RootCopyOptions, type RootCreateJsonOptions, type RootCreateOptions, type RootDefaults, type RootMkdirOptions, type RootMoveOptions, type RootOpenOptions, type RootOpenWritableOptions, type RootOptions, type RootReadOptions, type RootRemoveOptions, type RootWriteJsonOptions, type RootWriteOptions, type SymlinkPolicy, type WritableOpenMode, type WritableOpenResult, } from "./root.js";
 export { configureFsSafePython, getFsSafePythonConfig, type FsSafePythonConfig, type FsSafePythonMode, } from "./pinned-python-config.js";
 export { writeExternalFileWithinRoot, type ExternalFileWriteOptions, type ExternalFileWriteResult, } from "./output.js";
 export { configureFsSafeLocks, getFsSafeLockConfig, type FsSafeLockConfig, } from "./lock-config.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,IAAI,EACJ,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,IAAI,EACJ,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC"}

package/dist/json-durable-queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAOF,eAAO,MAAM,0CAA0C,QAAmB,CAAC;AAY3E,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAM5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AA+KD,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAiDD,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAwBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CAkDd;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}
+{"version":3,"file":"json-durable-queue.d.ts","sourceRoot":"","sources":["../src/json-durable-queue.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAOF,eAAO,MAAM,0CAA0C,QAAmB,CAAC;AAY3E,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUpF;AAmBD,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT,0BAA0B,CAM5B;AAED,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AA+KD,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAsDD,wBAAsB,yBAAyB,CAAC,CAAC,EAC/C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAClC,OAAO,CAAC,CAAC,CAAC,CAOZ;AAED,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAW/F;AAED,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,MAAM,EAAE;IACzD,KAAK,EAAE,0BAA0B,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAwBpB;AAED,wBAAsB,kCAAkC,CAAC,CAAC,EACxD,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,CAAC,EAAE,CAAC,CAkDd;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB"}

package/dist/json-durable-queue.js

@@ -215,6 +215,9 @@ async function readBoundedUtf8File(params) {
     if (initialStat.isSymbolicLink() || !initialStat.isFile()) {
         throw new Error("queue entry is not a regular file");
     }
+    if (initialStat.nlink > 1) {
+        throw new Error("queue entry hardlinks are not allowed");
+    }
     if (initialStat.size > params.maxBytes) {
         throw new Error(`queue entry exceeds ${params.maxBytes} bytes`);
     }
@@ -228,6 +231,8 @@ async function readBoundedUtf8File(params) {
         if (!openedStat.isFile() ||
             pathStat.isSymbolicLink() ||
             !pathStat.isFile() ||
+            openedStat.nlink > 1 ||
+            pathStat.nlink > 1 ||
             !sameFileIdentity(initialStat, openedStat) ||
             !sameFileIdentity(pathStat, openedStat)) {
             throw new Error("queue entry changed during read");

package/dist/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAI7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA0FhF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAOvE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAmB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;gBAEtB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO;CAMvE;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CAwCjC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAOxE;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAY9D;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAe7E;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAY7D;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAS3B"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,SAAS,CAAC;AAK7B,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EAAmB,KAAK,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AA0IhF,wBAAgB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAOvE;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,QAmB5D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;gBAEtB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO;CAMvE;AAED,MAAM,MAAM,4BAA4B,CAAC,CAAC,IACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,iCAAiC,CAAC,CAAC,IAAI;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,IAAI,CACxC,iCAAiC,CAAC,OAAO,CAAC,EAC1C,OAAO,GAAG,UAAU,GAAG,gBAAgB,CACxC,CAAC;AAgBF,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,OAAO,EAAE,iCAAiC,CAAC,CAAC,CAAC,GAC5C,4BAA4B,CAAC,CAAC,CAAC,CAwCjC;AAED,wBAAgB,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1C,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,CAAC,CAAC,CAKjC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,4BAA4B,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAOvD;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAWxE;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAc9D;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmB7E;AAED,wBAAgB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAY7D;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,sBAAsB,EACtB,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,iBAAiB,CACnD,CAAC;AAEF,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,gBAAgB,iBAS3B"}