@openclaw/fs-safe 0.8.6 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.9.0 - 2026-09-11
+
+**Highlights:** Faster bulk extraction and configurable durability, with Windows filesystem fixes and reliable mixed-version lock cleanup.
+
+- **Compatibility:** `extractArchive` skips file and directory fsync by default for faster bulk imports; pass `durable: true` to restore the previous durability behavior.
+- Add store-level and per-call `durable` options to FileStore writes, streams, copies, and synchronous writes, plus JSON-store defaults, so reconstructible data can skip fsync while preserving guarded atomic publication.
+- Add `Root.copyIn({ durable: false })`, with per-call, root-default, then `true` precedence, to skip file and parent-directory fsync for reconstructible data.
+- Speed up archive extraction by omitting private staging syncs, deferring opted-in publication durability to one bounded file/directory pass, and sharing duplicate destination guards without weakening containment checks.
+- Keep process-exit lock cleanup working when a legacy shared manager lacks reclaim-guard state, continuing through later managers while preserving retained locks; thanks @metahacker.
+- Publish read-only modes such as `0o400` through the Windows JavaScript write fallback by retaining private `0o600` staging and applying the final mode through the retained handle after rename.
+- Preserve Windows file identity across open-induced `ctime` changes during guarded move fallback, and recreate directory junctions without requiring symlink privileges; thanks @giodl73-repo.
+- Extend synchronous metadata observations to archive, copy, publication, move, and directory-mode paths while keeping data and structural I/O asynchronous and preserving native canonical paths.
+- Keep durable publication coverage reliable under filesystem contention by allowing bounded I/O time and draining unfinished operations before fixture cleanup.
+- Refresh JSZip to 3.10.2, Node declarations to 26.5.1, emnapi runtime build tooling to 2.0.0-alpha.5, the Rust hybrid-array dependency to 0.4.15, and pinned CodeQL actions to 4.38.0.
+
 ## 0.8.6 - 2026-09-07
 
 **Highlights:** Clearer guidance for atomic writes on Windows exFAT, with a repeatable filesystem compatibility probe.

package/dist/archive-durability.d.ts

@@ -0,0 +1,24 @@
+import { type ExtractionDeadline } from "./archive-deadline.js";
+import type { AsyncDirectoryGuard } from "./directory-guard.js";
+import type { PublishedWriteIdentity } from "./pinned-write.js";
+import type { Root } from "./root.js";
+export type ArchivePublishedFile = {
+    relativePath: string;
+    identity: PublishedWriteIdentity;
+    guards: readonly AsyncDirectoryGuard[];
+};
+export type ArchivePublishedDirectory = {
+    guard: AsyncDirectoryGuard;
+    parents: readonly AsyncDirectoryGuard[];
+    mode: number;
+};
+export declare function finalizeArchivePublication(params: {
+    targetRoot: Root;
+    destinationGuard: AsyncDirectoryGuard;
+    sourceGuard: AsyncDirectoryGuard;
+    files: readonly ArchivePublishedFile[];
+    directories: readonly ArchivePublishedDirectory[];
+    durable: boolean;
+    deadline?: ExtractionDeadline;
+}): Promise<void>;
+//# sourceMappingURL=archive-durability.d.ts.map

package/dist/archive-durability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-durability.d.ts","sourceRoot":"","sources":["../src/archive-durability.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAIhE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAMtC,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,0BAA0B,CAAC,MAAM,EAAE;IACvD,UAAU,EAAE,IAAI,CAAC;IACjB,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACvC,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA4FhB"}

package/dist/archive-durability.js

@@ -0,0 +1,180 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import fsSync from "node:fs";
+import path from "node:path";
+import { ownExtractionDestinationMutation } from "./archive-deadline.js";
+import { assertDirectoryIdentityGuard, assertResolvedInsideDestination, createArchiveSymlinkTraversalError } from "./archive-staging.js";
+import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
+import { pinDirectory, syncDirectory } from "./directory-durability.js";
+import { syncFileBestEffort } from "./file-sync.js";
+import { normalizePinnedWriteError } from "./root-errors.js";
+import { inspectFileIdentity } from "./strict-file-identity.js";
+import { getFsSafeTestHooks } from "./test-hooks.js";
+import { FsSafeError } from "./errors.js";
+export async function finalizeArchivePublication(params) {
+    const check = () => params.deadline?.check();
+    const assertGuards = async (guards) => {
+        for (const guard of [params.destinationGuard, ...guards, params.sourceGuard]) {
+            await assertDirectoryIdentityGuard(guard);
+            check();
+        }
+    };
+    await ownExtractionDestinationMutation(params.deadline, async () => {
+        if (params.durable) {
+            // Join every active sync before propagating failure or starting another batch.
+            for (let offset = 0; offset < params.files.length; offset += 8) {
+                check();
+                const results = await Promise.allSettled(params.files.slice(offset, offset + 8).map(async (file) => {
+                    const env_1 = { stack: [], error: void 0, hasError: false };
+                    try {
+                        await assertGuards(file.guards);
+                        const opened = __addDisposableResource(env_1, await params.targetRoot.open(file.relativePath, { hardlinks: "reject", symlinks: "reject" })
+                            .catch((error) => {
+                            if (error instanceof FsSafeError && (error.code === "hardlink" || error.code === "path-alias")) {
+                                throw createArchiveSymlinkTraversalError(file.relativePath);
+                            }
+                            throw error;
+                        }), true);
+                        check();
+                        await inspectFileIdentity(() => fsSync.fstatSync(opened.handle.fd, { bigint: true }), file.identity);
+                        check();
+                        await syncFileBestEffort(opened.handle).catch((error) => { throw normalizePinnedWriteError(error); });
+                        check();
+                        await assertGuards(file.guards);
+                        await inspectFileIdentity(async () => {
+                            const stat = fsSync.lstatSync(opened.realPath, { bigint: true });
+                            if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink > 1n) {
+                                throw new FsSafeError("path-mismatch", "archive file changed during durability pass");
+                            }
+                            return stat;
+                        }, file.identity);
+                        check();
+                    }
+                    catch (e_1) {
+                        env_1.error = e_1;
+                        env_1.hasError = true;
+                    }
+                    finally {
+                        const result_1 = __disposeResources(env_1);
+                        if (result_1)
+                            await result_1;
+                    }
+                }));
+                const failure = results.find((result) => result.status === "rejected");
+                if (failure?.status === "rejected")
+                    throw failure.reason;
+            }
+        }
+        // Leave working modes intact until file syncing finishes. Re-pin one directory
+        // at a time against its original guard, so wide archives do not exhaust fds.
+        const directories = [...params.directories].sort((a, b) => b.guard.dir.split(path.sep).length - a.guard.dir.split(path.sep).length);
+        for (const directory of directories) {
+            const guards = [...directory.parents, directory.guard];
+            await assertGuards(guards);
+            const owner = await pinNodeDirectoryForMode(directory.guard.dir);
+            let pinned;
+            try {
+                check();
+                await assertGuards(guards);
+                if (params.durable && process.platform !== "win32") {
+                    // An existing search-only directory may become readable in its final mode.
+                    try {
+                        pinned = await pinDirectory(directory.guard.dir);
+                    }
+                    catch (error) {
+                        if (error.code !== "EACCES")
+                            throw error;
+                    }
+                    check();
+                }
+                await getFsSafeTestHooks()?.beforeArchiveOutputMutation?.("chmod", directory.guard.dir);
+                check();
+                await assertGuards(guards);
+                await owner.apply(directory.mode, { check, beforeChmod: async () => {
+                        await assertGuards(guards);
+                        await assertResolvedInsideDestination({ destinationRealDir: params.destinationGuard.realPath,
+                            targetPath: directory.guard.dir, originalPath: path.relative(params.targetRoot.rootDir, directory.guard.dir) });
+                        check();
+                    } });
+                check();
+                await assertGuards(guards);
+                if (params.durable) {
+                    if (process.platform === "win32") {
+                        await syncDirectory(directory.guard.dir).catch((error) => { throw normalizePinnedWriteError(error); });
+                    }
+                    else {
+                        pinned ??= await pinDirectory(directory.guard.dir);
+                        check();
+                        await pinned.sync().catch((error) => { throw normalizePinnedWriteError(error); });
+                    }
+                    check();
+                    await assertGuards(guards);
+                }
+            }
+            finally {
+                try {
+                    await pinned?.close();
+                }
+                finally {
+                    await owner.close();
+                }
+            }
+        }
+        if (params.durable) {
+            await assertGuards([]);
+            await syncDirectory(params.destinationGuard.realPath).catch((error) => { throw normalizePinnedWriteError(error); });
+            check();
+            await assertGuards([]);
+        }
+    });
+}

package/dist/archive-gzip-tail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-gzip-tail.d.ts","sourceRoot":"","sources":["../src/archive-gzip-tail.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC;8EAC8E;AAC9E,qBAAa,SAAU,SAAQ,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAqB;IAExC,YAA6B,OAAO,EAAE,MAAM,EAE3C;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEQ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAcxG;IAEQ,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAE9D;IAEQ,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAGpF;CACF;AAED;6EAC6E;AAC7E,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvH"}
+{"version":3,"file":"archive-gzip-tail.d.ts","sourceRoot":"","sources":["../src/archive-gzip-tail.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC;8EAC8E;AAC9E,qBAAa,SAAU,SAAQ,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,WAAW,CAAqB;IAExC,YAA6B,OAAO,EAAE,MAAM,EAE3C;IAED,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEQ,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAcxG;IAEQ,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAE9D;IAEQ,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI,CAGpF;CACF;AAED;6EAC6E;AAC7E,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBvH"}

package/dist/archive-gzip-tail.js

@@ -1,3 +1,4 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import { Writable } from "node:stream";
 import { ArchiveFormatError } from "./archive-errors.js";
@@ -48,7 +49,7 @@ export async function validateGzipContainerTail(filePath, consumed, signal) {
     signal?.throwIfAborted();
     const handle = await fs.open(filePath, "r");
     try {
-        const { size } = await handle.stat();
+        const { size } = fsSync.fstatSync(handle.fd);
         if (!Number.isSafeInteger(consumed) || consumed <= 0 || consumed > size) {
             throw new ArchiveFormatError("invalid gzip consumed-input boundary");
         }

package/dist/archive-input.js

@@ -1,4 +1,4 @@
-import { constants as fsConstants } from "node:fs";
+import fsSync, { constants as fsConstants } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { ARCHIVE_LIMIT_ERROR_CODE, ArchiveLimitError, } from "./archive-limits.js";
@@ -25,7 +25,7 @@ export async function stageArchiveFileForExtraction(params) {
     params.deadline.check();
     const sourcePath = path.resolve(params.archivePath);
     const initialStat = await inspectFileIdentity(async () => {
-        const stat = await fs.lstat(sourcePath, { bigint: true });
+        const stat = fsSync.lstatSync(sourcePath, { bigint: true });
         if (stat.isSymbolicLink() || !stat.isFile()) {
             throw new Error(`archive is not a regular file: ${params.archivePath}`);
         }
@@ -43,13 +43,13 @@ export async function stageArchiveFileForExtraction(params) {
             fileName: path.basename(sourcePath),
         });
         const opened = await inspectFileIdentity(async () => {
-            const stat = await handle.stat({ bigint: true });
+            const stat = fsSync.fstatSync(handle.fd, { bigint: true });
             if (!stat.isFile())
                 throw new Error("archive changed during validation");
             return stat;
         }, initialStat);
         await inspectFileIdentity(async () => {
-            const stat = await fs.lstat(sourcePath, { bigint: true });
+            const stat = fsSync.lstatSync(sourcePath, { bigint: true });
             if (stat.isSymbolicLink() || !stat.isFile())
                 throw new Error("archive changed during validation");
             return stat;

package/dist/archive-kind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-kind.d.ts","sourceRoot":"","sources":["../src/archive-kind.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;AAmBnE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAcvE;AAED,KAAK,2BAA2B,GAAG;IACjC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAkBF,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAQjE"}
+{"version":3,"file":"archive-kind.d.ts","sourceRoot":"","sources":["../src/archive-kind.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,GAAG,KAAK,CAAC;AAmBnE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAcvE;AAED,KAAK,2BAA2B,GAAG;IACjC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAkBF,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,2BAA2B,GACpC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAQjE"}

package/dist/archive-kind.js

@@ -1,3 +1,4 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { FsSafeError } from "./errors.js";
@@ -37,7 +38,7 @@ async function hasPackedRootMarker(extractDir, rootMarkers) {
             continue;
         }
         try {
-            await fs.stat(path.join(extractDir, trimmed));
+            fsSync.statSync(path.join(extractDir, trimmed));
             return true;
         }
         catch {
@@ -49,7 +50,7 @@ async function hasPackedRootMarker(extractDir, rootMarkers) {
 export async function resolvePackedRootDir(extractDir, options) {
     const direct = path.join(extractDir, "package");
     try {
-        const stat = await fs.stat(direct);
+        const stat = fsSync.statSync(direct);
         if (stat.isDirectory()) {
             return direct;
         }

package/dist/archive-merge.d.ts

@@ -12,6 +12,7 @@ type MergeParams = {
 };
 export declare function mergePlannedArchiveIntoDestination(params: MergeParams & {
     entries: readonly ArchivePublicationEntry[];
+    durable?: boolean;
 }): Promise<void>;
 export declare function mergeExtractedTreeIntoDestination(params: MergeParams): Promise<void>;
 export {};

package/dist/archive-merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-merge.d.ts","sourceRoot":"","sources":["../src/archive-merge.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAelG,MAAM,MAAM,uBAAuB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACjG,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,WAAW,GAAG;IAAE,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAA;CAAE,GACpE,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F"}
+{"version":3,"file":"archive-merge.d.ts","sourceRoot":"","sources":["../src/archive-merge.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoC,KAAK,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAkBlG,MAAM,MAAM,uBAAuB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACjG,KAAK,WAAW,GAAG;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,WAAW,GAAG;IAAE,OAAO,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACvF,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F"}

package/dist/archive-merge.js

@@ -1,3 +1,4 @@
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { ownExtractionDestinationMutation } from "./archive-deadline.js";
@@ -10,13 +11,18 @@ import { formatErrorDetail } from "./error-detail.js";
 import { isPathInside } from "./path.js";
 import { root } from "./root.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
+import { onCopyPublication } from "./copy-publication.js";
+import { syncFileBestEffortSync } from "./file-sync.js";
+import { finalizeArchivePublication } from "./archive-durability.js";
 export async function mergePlannedArchiveIntoDestination(params) {
-    await mergeTree(params, params.entries);
+    await mergeTree(params, params.entries, params.durable === true);
 }
 export async function mergeExtractedTreeIntoDestination(params) {
     await mergeTree(params);
 }
-async function mergeTree(params, publication) {
+async function mergeTree(params, publication, durable = true) {
+    const publishedFiles = [];
+    const publishedDirectories = [];
     const check = () => params.deadline?.check();
     check();
     const destinationGuard = await createDirectoryIdentityGuard(params.destinationRealDir);
@@ -29,7 +35,7 @@ async function mergeTree(params, publication) {
     for (const entry of publication ?? []) {
         // Resolve admitted spelling in private staging, preserving the volume's case
         // and Unicode behavior without assigning explicit modes to distinct parents.
-        const stagedPath = await fs.realpath(path.join(params.sourceDir, entry.path));
+        const stagedPath = fsSync.realpathSync.native(path.join(params.sourceDir, entry.path));
         check();
         if (!isPathInside(sourceGuard.realPath, stagedPath) || plan.has(stagedPath)) {
             throw new FsSafeError("path-mismatch", "archive publication paths changed in staging");
@@ -59,11 +65,11 @@ async function mergeTree(params, publication) {
             const relPath = path.relative(params.sourceDir, sourcePath);
             const originalPath = relPath.split(path.sep).join("/");
             const destinationPath = path.join(params.destinationDir, relPath);
-            const sourceStat = await fs.lstat(sourcePath);
+            const sourceStat = fsSync.lstatSync(sourcePath);
             check();
             if (sourceStat.isSymbolicLink())
                 throw createArchiveSymlinkTraversalError(originalPath);
-            const sourceReal = await fs.realpath(sourcePath);
+            const sourceReal = fsSync.realpathSync.native(sourcePath);
             check();
             if (!isPathInside(sourceGuard.realPath, sourceReal))
                 throw createArchiveSymlinkTraversalError(originalPath);
@@ -78,7 +84,7 @@ async function mergeTree(params, publication) {
             const mode = plan ? planned?.mode ?? 0o755 : sourceStat.mode & 0o777;
             await preparePrivateArchiveOutputPath({
                 ...params, relPath, outPath: destinationPath, originalPath, isDirectory: kind === "directory",
-            }, assertGuards);
+            }, assertGuards, destinationGuard);
             check();
             if (kind === "directory") {
                 // Ownership spans open, descendants, finalization and close, including timeout.
@@ -98,6 +104,11 @@ async function mergeTree(params, publication) {
                         ancestors.push({ guard, owner });
                         try {
                             await walk(sourcePath);
+                            if (publication) {
+                                await assertGuards();
+                                publishedDirectories.push({ guard, mode, parents: ancestors.slice(0, -1).map((ancestor) => ancestor.guard) });
+                                return;
+                            }
                             await getFsSafeTestHooks()?.beforeArchiveOutputMutation?.("chmod", destinationPath);
                             check();
                             await assertGuards();
@@ -129,14 +140,32 @@ async function mergeTree(params, publication) {
                 await ownExtractionDestinationMutation(params.deadline, async () => {
                     await assertGuards();
                     try {
-                        await targetRoot.copyIn(relPath, sourcePath, { mkdir: true, mode });
+                        const options = {
+                            mkdir: true, mode, durable: publication ? false : true,
+                        };
+                        if (publication && durable) {
+                            options[onCopyPublication] = async (fd, identity) => {
+                                check();
+                                if ((mode & 0o400) === 0) {
+                                    // Final mode may prohibit reopening. Sync the writer's still-owned
+                                    // descriptor without widening permissions or syncing its parent.
+                                    syncFileBestEffortSync(fd);
+                                    check();
+                                }
+                                else {
+                                    publishedFiles.push({ relativePath: relPath, identity,
+                                        guards: ancestors.map((ancestor) => ancestor.guard) });
+                                }
+                            };
+                        }
+                        await targetRoot.copyIn(relPath, sourcePath, options);
                         check();
                         await assertGuards();
                         await assertResolvedInsideDestination({
                             destinationRealDir: params.destinationRealDir, targetPath: destinationPath, originalPath,
                         });
                         check();
-                        const stat = await fs.lstat(destinationPath);
+                        const stat = fsSync.lstatSync(destinationPath);
                         check();
                         if (stat.isSymbolicLink() || (stat.isFile() && stat.nlink > 1)) {
                             throw createArchiveSymlinkTraversalError(originalPath);
@@ -154,4 +183,8 @@ async function mergeTree(params, publication) {
         }
     };
     await walk(params.sourceDir);
+    if (publication) {
+        await finalizeArchivePublication({ targetRoot, destinationGuard, sourceGuard,
+            files: publishedFiles, directories: publishedDirectories, durable, deadline: params.deadline });
+    }
 }

package/dist/archive-native.d.ts

@@ -5,6 +5,7 @@ import type { ExtractArchiveOptions } from "./archive-options.js";
 import type { NativeBinding } from "./native.js";
 export declare function throwMappedNativeArchiveError(error: unknown): never;
 export declare function extractNativeArchive(params: {
+    durable?: boolean;
     binding: NativeBinding;
     archivePath: string;
     destDir: string;

package/dist/archive-native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-native.d.ts","sourceRoot":"","sources":["../src/archive-native.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAOlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAYnE;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,OAAO,EAAE,aAAa,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,4BAA4B,CAAC;IACrC,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,UAAU,CAAC,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACjD,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;CAClD,GAAG,OAAO,CAAC,IAAI,CAAC,CA6FhB"}
+{"version":3,"file":"archive-native.d.ts","sourceRoot":"","sources":["../src/archive-native.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAOlE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAYnE;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,4BAA4B,CAAC;IACrC,SAAS,EAAE,cAAc,CAAC;IAC1B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,UAAU,CAAC,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACjD,WAAW,CAAC,EAAE,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC;CAClD,GAAG,OAAO,CAAC,IAAI,CAAC,CA8FhB"}

package/dist/archive-native.js

@@ -92,6 +92,7 @@ export async function extractNativeArchive(params) {
                 params.deadline.check();
                 await mergePlannedArchiveIntoDestination({
                     entries: plan,
+                    durable: params.durable,
                     sourceDir: stagingDir,
                     destinationDir: params.destDir,
                     destinationRealDir,

package/dist/archive-options.d.ts

@@ -9,6 +9,8 @@ export type ExtractArchiveOptions = {
     archivePath: string;
     destDir: string;
     timeoutMs: number;
+    /** Sync published files and directories before returning. Defaults to false. */
+    durable?: boolean;
     kind?: ArchiveKind;
     stripComponents?: number;
     tarGzip?: boolean;

package/dist/archive-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-options.d.ts","sourceRoot":"","sources":["../src/archive-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,CAAC"}
+{"version":3,"file":"archive-options.d.ts","sourceRoot":"","sources":["../src/archive-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EACV,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,CAAC"}

package/dist/archive-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-read.d.ts","sourceRoot":"","sources":["../src/archive-read.ts"],"names":[],"mappings":"AAcA,OAAO,EAAiD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAkLpG,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,CAAA;CAAE,GAChD,OAAO,CAAC,MAAM,CAAC,CA6EjB"}
+{"version":3,"file":"archive-read.d.ts","sourceRoot":"","sources":["../src/archive-read.ts"],"names":[],"mappings":"AAeA,OAAO,EAAiD,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAkLpG,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,WAAW,CAAA;CAAE,GAChD,OAAO,CAAC,MAAM,CAAC,CA6EjB"}

package/dist/archive-read.js

@@ -1,4 +1,5 @@
 import { classifyArchiveParserError } from "./archive-parser-errors.js";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import { Readable } from "node:stream";
 import { readFileHandleBounded } from "./bounded-read.js";
@@ -63,9 +64,9 @@ async function readStreamBounded(stream, maxBytes) {
     return Buffer.concat(chunks, total);
 }
 async function stageArchiveInput(archivePath) {
-    const resolved = await fs.realpath(archivePath);
+    const resolved = fsSync.realpathSync.native(archivePath);
     const before = await inspectFileIdentity(async () => {
-        const stat = await fs.lstat(archivePath, { bigint: true });
+        const stat = fsSync.lstatSync(archivePath, { bigint: true });
         if (stat.isSymbolicLink() || !stat.isFile()) {
             throw new Error(`archive is not a regular file: ${archivePath}`);
         }
@@ -76,13 +77,13 @@ async function stageArchiveInput(archivePath) {
     try {
         staged = await tempFile({ prefix: "fs-safe-archive-read", fileName: "archive.bin" });
         const opened = await inspectFileIdentity(async () => {
-            const stat = await handle.stat({ bigint: true });
+            const stat = fsSync.fstatSync(handle.fd, { bigint: true });
             if (!stat.isFile())
                 throw new Error("archive changed during validation");
             return stat;
         }, before);
         await inspectFileIdentity(async () => {
-            const stat = await fs.lstat(resolved, { bigint: true });
+            const stat = fsSync.lstatSync(resolved, { bigint: true });
             if (stat.isSymbolicLink() || !stat.isFile())
                 throw new Error("archive changed during validation");
             return stat;

package/dist/archive-staging.d.ts

@@ -20,7 +20,7 @@ type ArchiveOutputPathParams = {
     deadline?: ExtractionDeadline;
 };
 export declare function prepareArchiveOutputPath(params: ArchiveOutputPathParams): Promise<void>;
-export declare function preparePrivateArchiveOutputPath(params: ArchiveOutputPathParams, assertGuards?: () => Promise<void>): Promise<void>;
+export declare function preparePrivateArchiveOutputPath(params: ArchiveOutputPathParams, assertGuards?: () => Promise<void>, destinationGuard?: AsyncDirectoryGuard): Promise<void>;
 export declare function withStagedArchiveDestination<T>(params: {
     destinationRealDir: string;
     stagingDirPrefix?: string;

package/dist/archive-staging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-staging.d.ts","sourceRoot":"","sources":["../src/archive-staging.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EAErB,MAAM,qBAAqB,CAAC;AAkB7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAS1F,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAS5F;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY5F;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BnF;AA0BD,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,uBAAuB,EAAE,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAClE,OAAO,CAAC,IAAI,CAAC,CAEf;AA8GD,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,CAAC,CAAC,CA6Bb;AAED,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AAEvE,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,CAE7F"}
+{"version":3,"file":"archive-staging.d.ts","sourceRoot":"","sources":["../src/archive-staging.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EAErB,MAAM,qBAAqB,CAAC;AAkB7B,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAS1F,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAS5F;AAED,wBAAsB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY5F;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BnF;AA0BD,wBAAsB,+BAA+B,CAAC,MAAM,EAAE;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAiBD,KAAK,uBAAuB,GAAG;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B,CAAC;AAEF,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,uBAAuB,EAAE,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACnE,gBAAgB,CAAC,EAAE,mBAAmB,GACrC,OAAO,CAAC,IAAI,CAAC,CAEf;AAkHD,wBAAsB,4BAA4B,CAAC,CAAC,EAAE,MAAM,EAAE;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACzC,GAAG,OAAO,CAAC,CAAC,CAAC,CA6Bb;AAED,OAAO,EAAE,iCAAiC,EAAE,MAAM,oBAAoB,CAAC;AAEvE,wBAAgB,kCAAkC,CAAC,YAAY,EAAE,MAAM,GAAG,oBAAoB,CAE7F"}