@openclaw/fs-safe 0.5.1 → 0.5.2

package/dist/output-sibling.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output-sibling.d.ts","sourceRoot":"","sources":["../src/output-sibling.ts"],"names":[],"mappings":"AAgGA,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,CAAC,CAAC,CA6Cb"}
+{"version":3,"file":"output-sibling.d.ts","sourceRoot":"","sources":["../src/output-sibling.ts"],"names":[],"mappings":"AA+FA,wBAAsB,2BAA2B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,CAAC,CAAC,CA8Cb"}

package/dist/output-sibling.js

@@ -66,11 +66,10 @@ async function cleanupTempPath(tempPath, identity) {
         if (!identity || (!current.isSymbolicLink() && sameFileIdentity(current, identity))) {
             await fs.rm(tempPath, { force: true });
         }
+        return true;
     }
     catch (error) {
-        if (error.code !== "ENOENT") {
-            // Cleanup is best-effort; the randomized path remains inside the writable boundary.
-        }
+        return error.code === "ENOENT";
     }
 }
 export async function writeExternalFileViaSibling(params) {
@@ -114,9 +113,11 @@ export async function writeExternalFileViaSibling(params) {
         return result;
     }
     finally {
+        let cleanupComplete = renamed;
         if (!renamed) {
-            await cleanupTempPath(tempPath, stagedIdentity);
+            cleanupComplete = await cleanupTempPath(tempPath, stagedIdentity);
         }
-        unregisterTempPath();
+        if (cleanupComplete)
+            unregisterTempPath();
     }
 }

package/dist/path-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,eAAO,MAAM,mBAAmB;;;;;;;;;CAA2B,CAAC;AAE5D,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}
+{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,eAAO,MAAM,mBAAmB;;;;;;;;;CAA2B,CAAC;AAE5D,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}

package/dist/path-policy.js

@@ -1,7 +1,7 @@
 import fs from "node:fs/promises";
-import os from "node:os";
 import { ROOT_PATH_ALIAS_POLICIES, resolveRootPath, } from "./root-path.js";
 import { isNotFoundPathError } from "./path.js";
+import { shortPath } from "./short-path.js";
 export const PATH_ALIAS_POLICIES = ROOT_PATH_ALIAS_POLICIES;
 export async function assertNoPathAliasEscape(params) {
     const resolved = await resolveRootPath({
@@ -42,9 +42,3 @@ export async function assertNoHardlinkedFinalPath(params) {
         throw new Error(`Hardlinked path is not allowed under ${params.boundaryLabel} (${shortPath(params.root)}): ${shortPath(params.filePath)}`);
     }
 }
-function shortPath(value) {
-    if (value.startsWith(os.homedir())) {
-        return `~${value.slice(os.homedir().length)}`;
-    }
-    return value;
-}

package/dist/path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAKzB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA4BlE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAUT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAuBpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrF"}
+{"version":3,"file":"path.d.ts","sourceRoot":"","sources":["../src/path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AAMzB,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,GAChC,MAAM,kBAAkB,CAAC;AAM1B,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,SAA6B,GAAG,IAAI,CAIjG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CA4BlE;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1D;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,IAAI,CAa/F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAChE,OAAO,CAUT;AAED,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC,KAAK,GAAG,IAAI,CAMhE;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CA0BpE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAOrF"}

package/dist/path.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
+import { isDriveRelativePath } from "./safe-path-segment.js";
 export { assertNoUnsafeDeviceReadPath, isUnsafeDeviceReadPath, matchUnsafeDeviceReadPath, } from "./device-path.js";
 const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
 const SYMLINK_OPEN_CODES = new Set(["ELOOP", "EINVAL", "ENOTSUP"]);
@@ -119,6 +120,9 @@ export function splitSafeRelativePath(relativePath) {
         if (segment === "..") {
             throw new FsSafeError("invalid-path", "relative path must not contain '..'");
         }
+        if (isDriveRelativePath(segment)) {
+            throw new FsSafeError("invalid-path", "relative path must not contain a drive letter");
+        }
     }
     return segments;
 }

package/dist/permission-exec.d.ts

@@ -0,0 +1,6 @@
+export declare const DEFAULT_PERMISSION_EXEC_TIMEOUT_MS = 30000;
+export declare function executePermissionCommand(command: string, args: string[], timeoutMs?: number): Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+//# sourceMappingURL=permission-exec.d.ts.map

package/dist/permission-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-exec.d.ts","sourceRoot":"","sources":["../src/permission-exec.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kCAAkC,QAAS,CAAC;AAEzD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,SAAS,SAAqC,GAC7C,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB7C"}

package/dist/permission-exec.js

@@ -0,0 +1,28 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export const DEFAULT_PERMISSION_EXEC_TIMEOUT_MS = 30_000;
+export async function executePermissionCommand(command, args, timeoutMs = DEFAULT_PERMISSION_EXEC_TIMEOUT_MS) {
+    try {
+        return (await execFileAsync(command, args, {
+            encoding: "utf8",
+            windowsHide: true,
+            maxBuffer: 1024 * 1024,
+            timeout: timeoutMs,
+            killSignal: "SIGKILL",
+        }));
+    }
+    catch (err) {
+        if (err &&
+            typeof err === "object" &&
+            "killed" in err &&
+            err.killed === true &&
+            "signal" in err &&
+            err.signal === "SIGKILL") {
+            throw new Error(`Windows permission inspection timed out after ${timeoutMs}ms`, {
+                cause: err,
+            });
+        }
+        throw err;
+    }
+}

package/dist/permissions-windows.d.ts

@@ -0,0 +1,56 @@
+import type { PermissionCheck, PermissionCheckOptions, SafeStatResult } from "./permissions.js";
+export type PermissionExec = (command: string, args: string[]) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export type WindowsAclEntry = {
+    principal: string;
+    /** Canonical principal SID when resolved from Windows. */
+    sid?: string;
+    rights: string[];
+    rawRights: string;
+    canRead: boolean;
+    canWrite: boolean;
+};
+export type WindowsAclSummary = {
+    ok: boolean;
+    entries: WindowsAclEntry[];
+    untrustedWorld: WindowsAclEntry[];
+    untrustedGroup: WindowsAclEntry[];
+    trusted: WindowsAclEntry[];
+    error?: string;
+};
+export type WindowsUserInfoProvider = () => {
+    username?: string | null;
+};
+export type IcaclsResetCommandOptions = {
+    isDir: boolean;
+    env?: NodeJS.ProcessEnv;
+    userInfo?: WindowsUserInfoProvider;
+};
+export declare function inspectWindowsPermissions(params: {
+    targetPath: string;
+    stat: SafeStatResult;
+    effectiveIsDir: boolean;
+    effectiveMode: number | null;
+    bits: number | null;
+    opts?: PermissionCheckOptions;
+}): Promise<PermissionCheck>;
+export declare function resolveWindowsUserPrincipal(env?: NodeJS.ProcessEnv, userInfo?: WindowsUserInfoProvider): string | null;
+export declare function parseIcaclsOutput(output: string, targetPath: string): WindowsAclEntry[];
+export declare function summarizeWindowsAcl(entries: WindowsAclEntry[], env?: NodeJS.ProcessEnv): Pick<WindowsAclSummary, "trusted" | "untrustedWorld" | "untrustedGroup">;
+export declare function inspectWindowsAcl(targetPath: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    exec?: PermissionExec;
+    currentUserSid?: string;
+    principalSids?: Record<string, string>;
+    principalTranslationFailed?: boolean;
+}): Promise<WindowsAclSummary>;
+export declare function formatWindowsAclSummary(summary: WindowsAclSummary): string;
+export declare function formatIcaclsResetCommand(targetPath: string, opts: IcaclsResetCommandOptions): string;
+export declare function createIcaclsResetCommand(targetPath: string, opts: IcaclsResetCommandOptions): {
+    command: string;
+    args: string[];
+    display: string;
+} | null;
+//# sourceMappingURL=permissions-windows.d.ts.map

package/dist/permissions-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-windows.d.ts","sourceRoot":"","sources":["../src/permissions-windows.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAShG,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AAyEF,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,cAAc,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,EAAE,sBAAsB,CAAC;CAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CAmD3B;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAKf;AAyDD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAgBvF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAYjK;AAED,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,0BAA0B,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4BxP;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAI1E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,MAAM,CAKpG;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAMzJ"}

package/dist/permissions-windows.js

@@ -0,0 +1,285 @@
+import os from "node:os";
+import { getNativeBinding } from "./native.js";
+import { executePermissionCommand } from "./permission-exec.js";
+import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
+import { resolveWindowsSystemCommand } from "./windows-command.js";
+import { inspectWindowsOwner, resolveWindowsCurrentUserSid, resolveWindowsPrincipalSids, } from "./windows-owner.js";
+const INHERIT_FLAGS = new Set(["I", "OI", "CI", "IO", "NP"]);
+const WORLD_PRINCIPALS = new Set(["everyone", "users", "builtin\\users", "authenticated users", "nt authority\\authenticated users", "anonymous logon", "nt authority\\anonymous logon", "guests", "builtin\\guests", "interactive", "nt authority\\interactive", "network", "nt authority\\network", "local"]);
+const TRUSTED_BASE = new Set([
+    "nt authority\\system",
+    "system",
+    "builtin\\administrators",
+    "creator owner",
+    "autorite nt\\système",
+    "nt-autorität\\system",
+    "autoridad nt\\system",
+    "autoridade nt\\system",
+]);
+const WORLD_SUFFIXES = ["\\users", "\\authenticated users"];
+const SID_RE = /^\*?s-\d+-\d+(-\d+)+$/i;
+const TRUSTED_SIDS = new Set([
+    "s-1-5-18",
+    "s-1-5-32-544",
+    "s-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
+]);
+const WORLD_SIDS = new Set(["s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7", "s-1-5-32-546", "s-1-5-4", "s-1-2-0", "s-1-5-2"]);
+const STATUS_PREFIXES = [
+    "successfully processed",
+    "processed",
+    "failed processing",
+    "no mapping between account names",
+];
+function stripDiacritics(value) {
+    return value.normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+}
+const TRUSTED_BASE_ASCII = new Set([...TRUSTED_BASE].map(stripDiacritics));
+const normalize = (value) => normalizeLowercaseStringOrEmpty(value);
+const defaultWindowsUserInfo = () => os.userInfo();
+const defaultPermissionExec = executePermissionCommand;
+function inspectWindowsPermissionsNative(params) {
+    const native = getNativeBinding();
+    if (!native)
+        return undefined;
+    try {
+        const facts = native.readOwnerAndDacl(params.targetPath);
+        if (facts.fallbackRequired)
+            return undefined;
+        return {
+            ok: true,
+            isSymlink: params.stat.isSymlink,
+            isDir: params.effectiveIsDir,
+            mode: params.effectiveMode,
+            bits: params.bits,
+            source: "windows-acl",
+            worldWritable: facts.worldWritable,
+            groupWritable: facts.groupWritable,
+            worldReadable: facts.worldReadable,
+            groupReadable: facts.groupReadable,
+            ownerSid: facts.ownerSid,
+            ownerTrusted: facts.ownerClass !== "foreign",
+            aclSummary: `native owner=${facts.ownerClass} world=` +
+                `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
+                `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function inspectWindowsPermissions(params) {
+    const native = inspectWindowsPermissionsNative(params);
+    if (native)
+        return native;
+    const unverified = {
+        ok: true,
+        isSymlink: params.stat.isSymlink,
+        isDir: params.effectiveIsDir,
+        mode: params.effectiveMode,
+        bits: params.bits,
+        source: "unknown",
+        worldWritable: false,
+        groupWritable: false,
+        worldReadable: false,
+        groupReadable: false,
+    };
+    const owner = await inspectWindowsOwner({
+        targetPath: params.targetPath,
+        env: params.opts?.env,
+        exec: params.opts?.exec ?? defaultPermissionExec,
+    });
+    if (owner.error) {
+        const error = `Windows owner inspection failed: ${owner.error}`;
+        return { ...unverified, ownerError: owner.error, error };
+    }
+    const acl = await inspectWindowsAcl(params.targetPath, {
+        env: params.opts?.env,
+        exec: params.opts?.exec,
+        currentUserSid: owner.currentUserSid,
+        principalSids: owner.principalSids,
+        principalTranslationFailed: owner.principalTranslationFailed,
+    });
+    const ownerFields = {
+        ...(owner.sid ? { ownerSid: owner.sid } : {}),
+        ...(owner.trusted !== undefined ? { ownerTrusted: owner.trusted } : {}),
+        ...(owner.error ? { ownerError: owner.error } : {}),
+    };
+    if (!acl.ok)
+        return { ...unverified, ...ownerFields, error: acl.error };
+    return {
+        ok: true,
+        isSymlink: params.stat.isSymlink,
+        isDir: params.effectiveIsDir,
+        mode: params.effectiveMode,
+        bits: params.bits,
+        source: "windows-acl",
+        worldWritable: acl.untrustedWorld.some((entry) => entry.canWrite),
+        groupWritable: acl.untrustedGroup.some((entry) => entry.canWrite),
+        worldReadable: acl.untrustedWorld.some((entry) => entry.canRead),
+        groupReadable: acl.untrustedGroup.some((entry) => entry.canRead),
+        ...ownerFields,
+        aclSummary: formatWindowsAclSummary(acl),
+    };
+}
+function normalizeSid(value) {
+    const normalized = normalize(value);
+    return normalized.startsWith("*") ? normalized.slice(1) : normalized;
+}
+export function resolveWindowsUserPrincipal(env, userInfo = defaultWindowsUserInfo) {
+    const username = env?.USERNAME?.trim() || userInfo().username?.trim();
+    if (!username)
+        return null;
+    const domain = env?.USERDOMAIN?.trim();
+    return domain ? `${domain}\\${username}` : username;
+}
+function buildTrustedPrincipals(env) {
+    const trusted = new Set(TRUSTED_BASE);
+    const principal = resolveWindowsUserPrincipal(env);
+    if (principal) {
+        trusted.add(normalize(principal));
+        const userOnly = principal.split("\\").at(-1);
+        if (userOnly)
+            trusted.add(normalize(userOnly));
+    }
+    const userSid = normalizeSid(env?.USERSID ?? "");
+    if (userSid && SID_RE.test(userSid) && !WORLD_SIDS.has(userSid))
+        trusted.add(userSid);
+    return trusted;
+}
+function classifyPrincipal(principal, trustedPrincipals) {
+    const normalized = normalize(principal);
+    if (SID_RE.test(normalized)) {
+        const sid = normalizeSid(normalized);
+        if (WORLD_SIDS.has(sid))
+            return "world";
+        if (TRUSTED_SIDS.has(sid) || trustedPrincipals.has(sid))
+            return "trusted";
+        return "group";
+    }
+    if (trustedPrincipals.has(normalized) || TRUSTED_BASE.has(normalized))
+        return "trusted";
+    if (WORLD_PRINCIPALS.has(normalized) || WORLD_SUFFIXES.some((suffix) => normalized.endsWith(suffix)))
+        return "world";
+    const stripped = stripDiacritics(normalized);
+    return stripped !== normalized && TRUSTED_BASE_ASCII.has(stripped) ? "trusted" : "group";
+}
+function rightsFromTokens(tokens) {
+    const upper = tokens.join("").toUpperCase();
+    return {
+        canWrite: upper.includes("F") || upper.includes("M") || upper.includes("W") || upper.includes("D"),
+        canRead: upper.includes("F") || upper.includes("M") || upper.includes("R"),
+    };
+}
+function stripTargetPrefix(params) {
+    if (params.lowerLine.startsWith(params.lowerTarget))
+        return params.trimmedLine.slice(params.normalizedTarget.length).trim();
+    if (params.lowerLine.startsWith(params.quotedLower))
+        return params.trimmedLine.slice(params.quotedTarget.length).trim();
+    return params.trimmedLine;
+}
+function parseAceEntry(entry) {
+    if (!entry.includes("("))
+        return null;
+    const idx = entry.indexOf(":");
+    if (idx === -1)
+        return null;
+    const principal = entry.slice(0, idx).trim();
+    const rawRights = entry.slice(idx + 1).trim();
+    const tokens = rawRights.match(/\(([^)]+)\)/g)?.map((token) => token.slice(1, -1).trim()).filter(Boolean) ?? [];
+    if (tokens.some((token) => token.toUpperCase() === "DENY"))
+        return null;
+    const rights = tokens.filter((token) => !INHERIT_FLAGS.has(token.toUpperCase()));
+    if (rights.length === 0)
+        return null;
+    const normalizedPrincipal = normalizeSid(principal);
+    return { principal, ...(SID_RE.test(normalizedPrincipal) ? { sid: normalizedPrincipal } : {}), rights, rawRights, ...rightsFromTokens(rights) };
+}
+export function parseIcaclsOutput(output, targetPath) {
+    const entries = [];
+    const normalizedTarget = targetPath.trim();
+    const lowerTarget = normalizedTarget.toLowerCase();
+    const quotedTarget = `"${normalizedTarget}"`;
+    const quotedLower = quotedTarget.toLowerCase();
+    for (const rawLine of output.split(/\r?\n/)) {
+        const line = rawLine.trimEnd();
+        if (!line.trim())
+            continue;
+        const trimmed = line.trim();
+        const lowerLine = trimmed.toLowerCase();
+        if (STATUS_PREFIXES.some((prefix) => lowerLine.startsWith(prefix)))
+            continue;
+        const parsed = parseAceEntry(stripTargetPrefix({ trimmedLine: trimmed, lowerLine, normalizedTarget, lowerTarget, quotedTarget, quotedLower }));
+        if (parsed)
+            entries.push(parsed);
+    }
+    return entries;
+}
+export function summarizeWindowsAcl(entries, env) {
+    const trustedPrincipals = buildTrustedPrincipals(env);
+    const trusted = [];
+    const untrustedWorld = [];
+    const untrustedGroup = [];
+    for (const entry of entries) {
+        const classification = classifyPrincipal(entry.sid ?? entry.principal, trustedPrincipals);
+        if (classification === "trusted")
+            trusted.push(entry);
+        else if (classification === "world")
+            untrustedWorld.push(entry);
+        else
+            untrustedGroup.push(entry);
+    }
+    return { trusted, untrustedWorld, untrustedGroup };
+}
+export async function inspectWindowsAcl(targetPath, opts) {
+    const exec = opts?.exec ?? defaultPermissionExec;
+    try {
+        if (opts?.principalTranslationFailed)
+            throw new Error("Windows ACL principal SID translation failed");
+        const { stdout, stderr } = await exec(resolveWindowsSystemCommand("icacls.exe", opts?.env), [targetPath]);
+        let entries = parseIcaclsOutput(`${stdout}\n${stderr}`.trim(), targetPath);
+        if (!entries.length)
+            throw new Error("Windows ACL output could not be verified");
+        const unresolvedPrincipals = entries.filter((entry) => !entry.sid).map((entry) => entry.principal);
+        const principalSids = await resolveWindowsPrincipalSids({ principals: unresolvedPrincipals, known: opts?.principalSids, env: opts?.env, exec });
+        entries = entries.map((entry) => {
+            const sid = entry.sid ?? principalSids[entry.principal.toLowerCase()];
+            if (!sid)
+                throw new Error(`Windows ACL principal SID could not be verified: ${entry.principal}`);
+            return { ...entry, sid };
+        });
+        let currentUserSid = normalizeSid(opts?.currentUserSid ?? "");
+        let effectiveEnv = currentUserSid ? { USERSID: currentUserSid } : undefined;
+        let { trusted, untrustedWorld, untrustedGroup } = summarizeWindowsAcl(entries, effectiveEnv);
+        if (!currentUserSid && untrustedGroup.some((entry) => entry.sid && !TRUSTED_SIDS.has(entry.sid))) {
+            currentUserSid = (await resolveWindowsCurrentUserSid({ exec, env: opts?.env })) ?? "";
+            if (currentUserSid) {
+                effectiveEnv = { USERSID: currentUserSid };
+                ({ trusted, untrustedWorld, untrustedGroup } = summarizeWindowsAcl(entries, effectiveEnv));
+            }
+        }
+        return { ok: true, entries, trusted, untrustedWorld, untrustedGroup };
+    }
+    catch (err) {
+        return { ok: false, entries: [], trusted: [], untrustedWorld: [], untrustedGroup: [], error: String(err) };
+    }
+}
+export function formatWindowsAclSummary(summary) {
+    if (!summary.ok)
+        return "unknown";
+    const untrusted = [...summary.untrustedWorld, ...summary.untrustedGroup];
+    return untrusted.length === 0 ? "trusted-only" : untrusted.map((entry) => `${entry.principal}:${entry.rawRights}`).join(", ");
+}
+export function formatIcaclsResetCommand(targetPath, opts) {
+    const command = resolveWindowsSystemCommand("icacls.exe", opts.env);
+    const user = resolveWindowsUserPrincipal(opts.env, opts.userInfo) ?? "%USERNAME%";
+    const grant = opts.isDir ? "(OI)(CI)F" : "F";
+    return [command, `"${targetPath}"`, "/inheritance:r", "/grant:r", `"${user}:${grant}"`, "/grant:r", `"*S-1-5-18:${grant}"`].join(" ");
+}
+export function createIcaclsResetCommand(targetPath, opts) {
+    const user = resolveWindowsUserPrincipal(opts.env, opts.userInfo);
+    if (!user)
+        return null;
+    const grant = opts.isDir ? "(OI)(CI)F" : "F";
+    const args = [targetPath, "/inheritance:r", "/grant:r", `${user}:${grant}`, "/grant:r", `*S-1-5-18:${grant}`];
+    return { command: resolveWindowsSystemCommand("icacls.exe", opts.env), args, display: formatIcaclsResetCommand(targetPath, opts) };
+}

package/dist/permissions.d.ts

@@ -1,7 +1,6 @@
-export type PermissionExec = (command: string, args: string[]) => Promise<{
-    stdout: string;
-    stderr: string;
-}>;
+import { type PermissionExec } from "./permissions-windows.js";
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, } from "./permissions-windows.js";
+export type { IcaclsResetCommandOptions, PermissionExec, WindowsAclEntry, WindowsAclSummary, WindowsUserInfoProvider, } from "./permissions-windows.js";
 export type PermissionCheck = {
     ok: boolean;
     isSymlink: boolean;
@@ -36,31 +35,6 @@ export type SafeStatResult = {
     gid: number | null;
     error?: string;
 };
-export type WindowsAclEntry = {
-    principal: string;
-    /** Canonical principal SID when resolved from Windows. */
-    sid?: string;
-    rights: string[];
-    rawRights: string;
-    canRead: boolean;
-    canWrite: boolean;
-};
-export type WindowsAclSummary = {
-    ok: boolean;
-    entries: WindowsAclEntry[];
-    untrustedWorld: WindowsAclEntry[];
-    untrustedGroup: WindowsAclEntry[];
-    trusted: WindowsAclEntry[];
-    error?: string;
-};
-export type WindowsUserInfoProvider = () => {
-    username?: string | null;
-};
-export type IcaclsResetCommandOptions = {
-    isDir: boolean;
-    env?: NodeJS.ProcessEnv;
-    userInfo?: WindowsUserInfoProvider;
-};
 export declare function safeStat(targetPath: string): Promise<SafeStatResult>;
 export declare function inspectPathPermissions(targetPath: string, opts?: PermissionCheckOptions): Promise<PermissionCheck>;
 export declare function formatPermissionDetail(targetPath: string, perms: PermissionCheck): string;
@@ -77,21 +51,4 @@ export declare function isWorldWritable(bits: number | null): boolean;
 export declare function isGroupWritable(bits: number | null): boolean;
 export declare function isWorldReadable(bits: number | null): boolean;
 export declare function isGroupReadable(bits: number | null): boolean;
-export declare function resolveWindowsUserPrincipal(env?: NodeJS.ProcessEnv, userInfo?: WindowsUserInfoProvider): string | null;
-export declare function parseIcaclsOutput(output: string, targetPath: string): WindowsAclEntry[];
-export declare function summarizeWindowsAcl(entries: WindowsAclEntry[], env?: NodeJS.ProcessEnv): Pick<WindowsAclSummary, "trusted" | "untrustedWorld" | "untrustedGroup">;
-export declare function inspectWindowsAcl(targetPath: string, opts?: {
-    env?: NodeJS.ProcessEnv;
-    exec?: PermissionExec;
-    currentUserSid?: string;
-    principalSids?: Record<string, string>;
-    principalTranslationFailed?: boolean;
-}): Promise<WindowsAclSummary>;
-export declare function formatWindowsAclSummary(summary: WindowsAclSummary): string;
-export declare function formatIcaclsResetCommand(targetPath: string, opts: IcaclsResetCommandOptions): string;
-export declare function createIcaclsResetCommand(targetPath: string, opts: IcaclsResetCommandOptions): {
-    command: string;
-    args: string[];
-    display: string;
-} | null;
 //# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,KACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,cAAc,EAAE,eAAe,EAAE,CAAC;IAClC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC,CAAC;AA6CF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAkG1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAQT;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAOD,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,EACvB,QAAQ,GAAE,uBAAgD,GACzD,MAAM,GAAG,IAAI,CAOf;AAgGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,eAAe,EAAE,CAyBvF;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EAAE,EAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,CAY1E;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IACL,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,0BAA0B,CAAC,EAAE,OAAO,CAAC;CACtC,GACA,OAAO,CAAC,iBAAiB,CAAC,CAkD5B;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAM1E;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B,MAAM,CAaR;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,yBAAyB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmB7D"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,EAC3B,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC5C,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAsB1E;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAuD1B;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,MAAM,CAKzF;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,CAYT;AASD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAE5D"}