@openclaw/openshell-sandbox 2026.9.2 → 2026.9.4

package/node_modules/@openclaw/fs-safe/dist/root-path-existing.d.ts

@@ -0,0 +1,3 @@
+export declare function resolvePathViaExistingAncestor(targetPath: string): Promise<string>;
+export declare function resolvePathViaExistingAncestorSync(targetPath: string): string;
+//# sourceMappingURL=root-path-existing.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-path-existing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-path-existing.d.ts","sourceRoot":"","sources":["../src/root-path-existing.ts"],"names":[],"mappings":"AAoBA,wBAAsB,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0BxF;AAED,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA0B7E"}

package/node_modules/@openclaw/fs-safe/dist/root-path-existing.js

@@ -0,0 +1,68 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isNotFoundPathError } from "./path.js";
+function isFilesystemRoot(candidate) {
+    return path.parse(candidate).root === candidate;
+}
+async function pathExists(targetPath) {
+    try {
+        fs.lstatSync(targetPath);
+        return true;
+    }
+    catch (error) {
+        if (isNotFoundPathError(error)) {
+            return false;
+        }
+        throw error;
+    }
+}
+export async function resolvePathViaExistingAncestor(targetPath) {
+    const normalized = path.resolve(targetPath);
+    let cursor = normalized;
+    const missingSuffix = [];
+    while (!isFilesystemRoot(cursor) && !(await pathExists(cursor))) {
+        missingSuffix.unshift(path.basename(cursor));
+        const parent = path.dirname(cursor);
+        if (parent === cursor) {
+            break;
+        }
+        cursor = parent;
+    }
+    if (!(await pathExists(cursor))) {
+        return normalized;
+    }
+    try {
+        const resolvedAncestor = path.resolve(fs.realpathSync.native(cursor));
+        return missingSuffix.length === 0
+            ? resolvedAncestor
+            : path.resolve(resolvedAncestor, ...missingSuffix);
+    }
+    catch {
+        return normalized;
+    }
+}
+export function resolvePathViaExistingAncestorSync(targetPath) {
+    const normalized = path.resolve(targetPath);
+    let cursor = normalized;
+    const missingSuffix = [];
+    while (!isFilesystemRoot(cursor) && !fs.existsSync(cursor)) {
+        missingSuffix.unshift(path.basename(cursor));
+        const parent = path.dirname(cursor);
+        if (parent === cursor) {
+            break;
+        }
+        cursor = parent;
+    }
+    if (!fs.existsSync(cursor)) {
+        return normalized;
+    }
+    try {
+        const resolvedAncestor = path.resolve(fs.realpathSync(cursor));
+        return missingSuffix.length === 0
+            ? resolvedAncestor
+            : path.resolve(resolvedAncestor, ...missingSuffix);
+    }
+    catch {
+        return normalized;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-path-symlink.d.ts

@@ -0,0 +1,7 @@
+type ResolveSymlinkHopOptions = {
+    rejectUnresolved?: boolean;
+};
+export declare function resolveSymlinkHopPath(symlinkPath: string, options?: ResolveSymlinkHopOptions): Promise<string>;
+export declare function resolveSymlinkHopPathSync(symlinkPath: string, options?: ResolveSymlinkHopOptions): string;
+export {};
+//# sourceMappingURL=root-path-symlink.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-path-symlink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-path-symlink.d.ts","sourceRoot":"","sources":["../src/root-path-symlink.ts"],"names":[],"mappings":"AASA,KAAK,wBAAwB,GAAG;IAC9B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAiBF,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,wBAA6B,GACrC,MAAM,CAQR"}

package/node_modules/@openclaw/fs-safe/dist/root-path-symlink.js

@@ -0,0 +1,35 @@
+import fs from "node:fs";
+import path from "node:path";
+import { FsSafeError } from "./errors.js";
+import { isNotFoundPathError, isSymlinkOpenError } from "./path.js";
+import { resolvePathViaExistingAncestor, resolvePathViaExistingAncestorSync, } from "./root-path-existing.js";
+function normalizeSymlinkResolutionError(error, options) {
+    if (isSymlinkOpenError(error) ||
+        (options.rejectUnresolved && isNotFoundPathError(error))) {
+        throw new FsSafeError("symlink", "symlink path could not be resolved", {
+            cause: error instanceof Error ? error : undefined,
+        });
+    }
+    if (!isNotFoundPathError(error))
+        throw error;
+}
+export async function resolveSymlinkHopPath(symlinkPath, options = {}) {
+    try {
+        return path.resolve(fs.realpathSync.native(symlinkPath));
+    }
+    catch (error) {
+        normalizeSymlinkResolutionError(error, options);
+        const linkTarget = fs.readlinkSync(symlinkPath);
+        return resolvePathViaExistingAncestor(path.resolve(path.dirname(symlinkPath), linkTarget));
+    }
+}
+export function resolveSymlinkHopPathSync(symlinkPath, options = {}) {
+    try {
+        return path.resolve(fs.realpathSync(symlinkPath));
+    }
+    catch (error) {
+        normalizeSymlinkResolutionError(error, options);
+        const linkTarget = fs.readlinkSync(symlinkPath);
+        return resolvePathViaExistingAncestorSync(path.resolve(path.dirname(symlinkPath), linkTarget));
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/root-path.d.ts

@@ -0,0 +1,40 @@
+export { resolvePathViaExistingAncestorSync } from "./root-path-existing.js";
+type RootPathIntent = "read" | "write" | "create" | "delete" | "stat";
+export type RootPathAliasPolicy = {
+    allowFinalSymlinkForUnlink?: boolean;
+    allowFinalHardlinkForUnlink?: boolean;
+};
+export declare const ROOT_PATH_ALIAS_POLICIES: {
+    readonly strict: Readonly<{
+        allowFinalSymlinkForUnlink: false;
+        allowFinalHardlinkForUnlink: false;
+    }>;
+    readonly unlinkTarget: Readonly<{
+        allowFinalSymlinkForUnlink: true;
+        allowFinalHardlinkForUnlink: true;
+    }>;
+};
+type ResolveRootPathParams = {
+    absolutePath: string;
+    rootPath: string;
+    boundaryLabel: string;
+    intent?: RootPathIntent;
+    policy?: RootPathAliasPolicy;
+    rejectSymlinks?: boolean;
+    rejectUnresolvedSymlinks?: boolean;
+    skipLexicalRootCheck?: boolean;
+    rootCanonicalPath?: string;
+};
+type ResolvedRootPathKind = "missing" | "file" | "directory" | "symlink" | "other";
+export type ResolvedRootPath = {
+    absolutePath: string;
+    canonicalPath: string;
+    rootPath: string;
+    rootCanonicalPath: string;
+    relativePath: string;
+    exists: boolean;
+    kind: ResolvedRootPathKind;
+};
+export declare function resolveRootPath(params: ResolveRootPathParams): Promise<ResolvedRootPath>;
+export declare function resolveRootPathSync(params: ResolveRootPathParams): ResolvedRootPath;
+//# sourceMappingURL=root-path.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/root-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"root-path.d.ts","sourceRoot":"","sources":["../src/root-path.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,kCAAkC,EAAE,MAAM,yBAAyB,CAAC;AAE7E,KAAK,cAAc,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtE,MAAM,MAAM,mBAAmB,GAAG;IAChC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,CAAC;AAEF,eAAO,MAAM,wBAAwB;aACnC,MAAM;;;;aAIN,YAAY;;;;CAIJ,CAAC;AAEX,KAAK,qBAAqB,GAAG;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,oBAAoB,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEnF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,oBAAoB,CAAC;CAC5B,CAAC;AAEF,wBAAsB,eAAe,CACnC,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AAsCD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,gBAAgB,CAMnF"}

package/node_modules/@openclaw/fs-safe/dist/root-path.js

@@ -0,0 +1,481 @@
+import fs from "node:fs";
+import path from "node:path";
+import { formatErrorDetail, shortPath } from "./error-detail.js";
+import { FsSafeError } from "./errors.js";
+import { assertNoNulPathInput, isNotFoundPathError, isPathInside, isPathRelativeEscape, } from "./path.js";
+import { resolvePathViaExistingAncestor, resolvePathViaExistingAncestorSync, } from "./root-path-existing.js";
+import { resolveSymlinkHopPath, resolveSymlinkHopPathSync } from "./root-path-symlink.js";
+import { assertNoDriveRelativePathSegments } from "./safe-path-segment.js";
+export { resolvePathViaExistingAncestorSync } from "./root-path-existing.js";
+export const ROOT_PATH_ALIAS_POLICIES = {
+    strict: Object.freeze({
+        allowFinalSymlinkForUnlink: false,
+        allowFinalHardlinkForUnlink: false,
+    }),
+    unlinkTarget: Object.freeze({
+        allowFinalSymlinkForUnlink: true,
+        allowFinalHardlinkForUnlink: true,
+    }),
+};
+export async function resolveRootPath(params) {
+    try {
+        return await resolveRootPathInternal(params);
+    }
+    catch (error) {
+        throw sanitizeRootPathError(error);
+    }
+}
+async function resolveRootPathInternal(params) {
+    assertValidRootPathInputs(params);
+    const rootPath = path.resolve(params.rootPath);
+    const absolutePath = path.resolve(params.absolutePath);
+    const rootCanonicalPath = params.rootCanonicalPath
+        ? path.resolve(params.rootCanonicalPath)
+        : await resolvePathViaExistingAncestor(rootPath);
+    const context = createBoundaryResolutionContext({
+        resolveParams: params,
+        rootPath,
+        absolutePath,
+        rootCanonicalPath,
+        outsideLexicalCanonicalPath: await resolveOutsideLexicalCanonicalPathAsync({
+            rootPath,
+            absolutePath,
+        }),
+    });
+    const outsideResult = await resolveOutsideRootPathAsync({
+        boundaryLabel: params.boundaryLabel,
+        context,
+    });
+    if (outsideResult) {
+        return outsideResult;
+    }
+    return resolveRootPathLexicalAsync({
+        params,
+        absolutePath: context.absolutePath,
+        rootPath: context.rootPath,
+        rootCanonicalPath: context.rootCanonicalPath,
+    });
+}
+export function resolveRootPathSync(params) {
+    try {
+        return resolveRootPathSyncInternal(params);
+    }
+    catch (error) {
+        throw sanitizeRootPathError(error);
+    }
+}
+function resolveRootPathSyncInternal(params) {
+    assertValidRootPathInputs(params);
+    const rootPath = path.resolve(params.rootPath);
+    const absolutePath = path.resolve(params.absolutePath);
+    const rootCanonicalPath = params.rootCanonicalPath
+        ? path.resolve(params.rootCanonicalPath)
+        : resolvePathViaExistingAncestorSync(rootPath);
+    const context = createBoundaryResolutionContext({
+        resolveParams: params,
+        rootPath,
+        absolutePath,
+        rootCanonicalPath,
+        outsideLexicalCanonicalPath: resolveOutsideLexicalCanonicalPathSync({
+            rootPath,
+            absolutePath,
+        }),
+    });
+    const outsideResult = resolveOutsideRootPathSync({
+        boundaryLabel: params.boundaryLabel,
+        context,
+    });
+    if (outsideResult) {
+        return outsideResult;
+    }
+    return resolveRootPathLexicalSync({
+        params,
+        absolutePath: context.absolutePath,
+        rootPath: context.rootPath,
+        rootCanonicalPath: context.rootCanonicalPath,
+    });
+}
+function sanitizeRootPathError(error) {
+    if (error instanceof Error) {
+        error.message = formatErrorDetail(error.message);
+    }
+    return error;
+}
+function assertValidRootPathInputs(params) {
+    assertNoNulPathInput(params.rootPath, "root path contains a NUL byte");
+    assertNoNulPathInput(params.absolutePath, "absolute path contains a NUL byte");
+    assertNoEmbeddedDriveRelativeSegment(params.rootPath, "root path");
+    assertNoEmbeddedDriveRelativeSegment(params.absolutePath, "absolute path");
+    if (params.rootCanonicalPath !== undefined) {
+        assertNoNulPathInput(params.rootCanonicalPath, "canonical root path contains a NUL byte");
+        assertNoEmbeddedDriveRelativeSegment(params.rootCanonicalPath, "canonical root path");
+    }
+}
+function assertNoEmbeddedDriveRelativeSegment(filePath, label) {
+    if (process.platform !== "win32") {
+        return;
+    }
+    const root = path.parse(filePath).root;
+    assertNoDriveRelativePathSegments(filePath.slice(root.length).replaceAll("\\", "/"), label);
+}
+function createLexicalTraversalState(params) {
+    const rawAbsolutePath = params.params.absolutePath;
+    const rawRelativePath = rawPathRelativeToRoot(params.rootPath, rawAbsolutePath);
+    const relative = rawRelativePath ?? path.relative(params.rootPath, params.absolutePath);
+    return {
+        segments: splitTraversalSegments(relative),
+        allowFinalSymlink: params.params.policy?.allowFinalSymlinkForUnlink === true,
+        canonicalCursor: params.rootCanonicalPath,
+        lexicalCursor: params.rootPath,
+        preserveFinalSymlink: false,
+    };
+}
+function createLexicalTraversalContext(params) {
+    return {
+        state: createLexicalTraversalState(params),
+        resolveParams: params.params,
+        rootPath: params.rootPath,
+        rootCanonicalPath: params.rootCanonicalPath,
+        absolutePath: params.absolutePath,
+    };
+}
+function splitTraversalSegments(value) {
+    return value
+        .split(process.platform === "win32" ? /[\\/]+/ : /\/+/)
+        .filter((segment) => Boolean(segment) && segment !== ".");
+}
+function rawPathRelativeToRoot(rootPath, candidatePath) {
+    if (!path.isAbsolute(candidatePath)) {
+        return undefined;
+    }
+    const root = path.resolve(rootPath);
+    const candidate = process.platform === "win32"
+        ? candidatePath.replaceAll("/", path.sep)
+        : candidatePath;
+    if (candidate === root) {
+        return "";
+    }
+    const rootWithSep = root.endsWith(path.sep) ? root : `${root}${path.sep}`;
+    const candidatePrefix = candidate.slice(0, rootWithSep.length);
+    const prefixMatches = process.platform === "win32"
+        ? candidatePrefix.toLowerCase() === rootWithSep.toLowerCase()
+        : candidatePrefix === rootWithSep;
+    return prefixMatches ? candidate.slice(rootWithSep.length) : undefined;
+}
+function assertLexicalCursorInsideBoundary(context, candidatePath) {
+    assertInsideBoundary({
+        boundaryLabel: context.resolveParams.boundaryLabel,
+        rootCanonicalPath: context.rootCanonicalPath,
+        candidatePath,
+        absolutePath: context.absolutePath,
+    });
+}
+function applyMissingSuffixToCanonicalCursor(context, missingFromIndex) {
+    const missingSuffix = context.state.segments.slice(missingFromIndex);
+    for (const segment of missingSuffix) {
+        advanceCanonicalCursorForSegment(context, segment);
+    }
+}
+function advanceCanonicalCursorForSegment(context, segment) {
+    context.state.canonicalCursor = path.resolve(context.state.canonicalCursor, segment);
+    assertLexicalCursorInsideBoundary(context, context.state.canonicalCursor);
+}
+function finalizeLexicalResolution(context, kind) {
+    assertLexicalCursorInsideBoundary(context, context.state.canonicalCursor);
+    return buildResolvedRootPath({
+        absolutePath: context.absolutePath,
+        canonicalPath: context.state.canonicalCursor,
+        rootPath: context.rootPath,
+        rootCanonicalPath: context.rootCanonicalPath,
+        kind,
+    });
+}
+function handleLexicalLstatFailure(context, error, missingFromIndex) {
+    if (!isNotFoundPathError(error)) {
+        return false;
+    }
+    applyMissingSuffixToCanonicalCursor(context, missingFromIndex);
+    return true;
+}
+function lexicalStatDisposition(params) {
+    if (!params.isSymbolicLink)
+        return "continue";
+    if (params.rejectSymlinks === true && params.isLast) {
+        throw new FsSafeError("symlink", "symlink path component not allowed");
+    }
+    return params.allowFinalSymlink && params.isLast ? "break" : "resolve-link";
+}
+function applyResolvedSymlinkHop(context, linkCanonical) {
+    if (!isPathInside(context.rootCanonicalPath, linkCanonical)) {
+        throw symlinkEscapeError({
+            boundaryLabel: context.resolveParams.boundaryLabel,
+            rootCanonicalPath: context.rootCanonicalPath,
+            symlinkPath: context.state.lexicalCursor,
+        });
+    }
+    context.state.canonicalCursor = linkCanonical;
+    context.state.lexicalCursor = linkCanonical;
+}
+function applyParentTraversalStep(context) {
+    context.state.lexicalCursor = path.resolve(context.state.lexicalCursor, "..");
+    advanceCanonicalCursorForSegment(context, "..");
+}
+async function resolveRootPathLexicalAsync(params) {
+    const context = createLexicalTraversalContext(params);
+    const { state } = context;
+    for (let idx = 0; idx < state.segments.length; idx += 1) {
+        const segment = state.segments[idx] ?? "";
+        const isLast = idx === state.segments.length - 1;
+        if (segment === "..") {
+            applyParentTraversalStep(context);
+            continue;
+        }
+        state.lexicalCursor = path.join(state.lexicalCursor, segment);
+        let stat;
+        try {
+            stat = fs.lstatSync(state.lexicalCursor);
+        }
+        catch (error) {
+            if (handleLexicalLstatFailure(context, error, idx))
+                break;
+            throw error;
+        }
+        const isSymbolicLink = stat.isSymbolicLink();
+        const disposition = lexicalStatDisposition({
+            isSymbolicLink,
+            isLast,
+            rejectSymlinks: isSymbolicLink ? context.resolveParams.rejectSymlinks : undefined,
+            allowFinalSymlink: state.allowFinalSymlink,
+        });
+        if (disposition !== "resolve-link") {
+            state.preserveFinalSymlink = disposition === "break";
+            advanceCanonicalCursorForSegment(context, segment);
+            if (state.preserveFinalSymlink)
+                break;
+            continue;
+        }
+        const linkCanonical = await resolveSymlinkHopPath(state.lexicalCursor, {
+            rejectUnresolved: context.resolveParams.rejectUnresolvedSymlinks,
+        });
+        applyResolvedSymlinkHop(context, linkCanonical);
+        if (context.resolveParams.rejectSymlinks === true) {
+            throw new FsSafeError("symlink", "symlink path component not allowed");
+        }
+    }
+    const kind = await getPathKind(state.canonicalCursor, state.preserveFinalSymlink);
+    return finalizeLexicalResolution(context, kind);
+}
+function resolveRootPathLexicalSync(params) {
+    const context = createLexicalTraversalContext(params);
+    const { state } = context;
+    for (let idx = 0; idx < state.segments.length; idx += 1) {
+        const segment = state.segments[idx] ?? "";
+        const isLast = idx === state.segments.length - 1;
+        if (segment === "..") {
+            applyParentTraversalStep(context);
+            continue;
+        }
+        state.lexicalCursor = path.join(state.lexicalCursor, segment);
+        let stat;
+        try {
+            stat = fs.lstatSync(state.lexicalCursor);
+        }
+        catch (error) {
+            if (handleLexicalLstatFailure(context, error, idx))
+                break;
+            throw error;
+        }
+        const isSymbolicLink = stat.isSymbolicLink();
+        const disposition = lexicalStatDisposition({
+            isSymbolicLink,
+            isLast,
+            rejectSymlinks: isSymbolicLink ? context.resolveParams.rejectSymlinks : undefined,
+            allowFinalSymlink: state.allowFinalSymlink,
+        });
+        if (disposition !== "resolve-link") {
+            state.preserveFinalSymlink = disposition === "break";
+            advanceCanonicalCursorForSegment(context, segment);
+            if (state.preserveFinalSymlink)
+                break;
+            continue;
+        }
+        const linkCanonical = resolveSymlinkHopPathSync(state.lexicalCursor, {
+            rejectUnresolved: context.resolveParams.rejectUnresolvedSymlinks,
+        });
+        applyResolvedSymlinkHop(context, linkCanonical);
+        if (context.resolveParams.rejectSymlinks === true) {
+            throw new FsSafeError("symlink", "symlink path component not allowed");
+        }
+    }
+    const kind = getPathKindSync(state.canonicalCursor, state.preserveFinalSymlink);
+    return finalizeLexicalResolution(context, kind);
+}
+function resolveCanonicalOutsideLexicalPath(params) {
+    return params.outsideLexicalCanonicalPath ?? params.absolutePath;
+}
+function createBoundaryResolutionContext(params) {
+    const lexicalInside = isPathInside(params.rootPath, params.absolutePath);
+    const canonicalOutsideLexicalPath = resolveCanonicalOutsideLexicalPath({
+        absolutePath: params.absolutePath,
+        outsideLexicalCanonicalPath: params.outsideLexicalCanonicalPath,
+    });
+    assertLexicalBoundaryOrCanonicalAlias({
+        skipLexicalRootCheck: params.resolveParams.skipLexicalRootCheck,
+        lexicalInside,
+        canonicalOutsideLexicalPath,
+        rootCanonicalPath: params.rootCanonicalPath,
+        boundaryLabel: params.resolveParams.boundaryLabel,
+        rootPath: params.rootPath,
+        absolutePath: params.absolutePath,
+    });
+    return {
+        rootPath: params.rootPath,
+        absolutePath: params.absolutePath,
+        rootCanonicalPath: params.rootCanonicalPath,
+        lexicalInside,
+        canonicalOutsideLexicalPath,
+    };
+}
+async function resolveOutsideRootPathAsync(params) {
+    if (params.context.lexicalInside) {
+        return null;
+    }
+    const kind = await getPathKind(params.context.absolutePath, false);
+    return buildOutsideRootPathFromContext({
+        boundaryLabel: params.boundaryLabel,
+        context: params.context,
+        kind,
+    });
+}
+function resolveOutsideRootPathSync(params) {
+    if (params.context.lexicalInside) {
+        return null;
+    }
+    const kind = getPathKindSync(params.context.absolutePath, false);
+    return buildOutsideRootPathFromContext({
+        boundaryLabel: params.boundaryLabel,
+        context: params.context,
+        kind,
+    });
+}
+function buildOutsideRootPathFromContext(params) {
+    return buildOutsideLexicalRootPath({
+        boundaryLabel: params.boundaryLabel,
+        rootCanonicalPath: params.context.rootCanonicalPath,
+        absolutePath: params.context.absolutePath,
+        canonicalOutsideLexicalPath: params.context.canonicalOutsideLexicalPath,
+        rootPath: params.context.rootPath,
+        kind: params.kind,
+    });
+}
+async function resolveOutsideLexicalCanonicalPathAsync(params) {
+    if (isPathInside(params.rootPath, params.absolutePath)) {
+        return undefined;
+    }
+    return await resolvePathViaExistingAncestor(params.absolutePath);
+}
+function resolveOutsideLexicalCanonicalPathSync(params) {
+    if (isPathInside(params.rootPath, params.absolutePath)) {
+        return undefined;
+    }
+    return resolvePathViaExistingAncestorSync(params.absolutePath);
+}
+function buildOutsideLexicalRootPath(params) {
+    assertInsideBoundary({
+        boundaryLabel: params.boundaryLabel,
+        rootCanonicalPath: params.rootCanonicalPath,
+        candidatePath: params.canonicalOutsideLexicalPath,
+        absolutePath: params.absolutePath,
+    });
+    return buildResolvedRootPath({
+        absolutePath: params.absolutePath,
+        canonicalPath: params.canonicalOutsideLexicalPath,
+        rootPath: params.rootPath,
+        rootCanonicalPath: params.rootCanonicalPath,
+        kind: params.kind,
+    });
+}
+function assertLexicalBoundaryOrCanonicalAlias(params) {
+    if (params.skipLexicalRootCheck || params.lexicalInside) {
+        return;
+    }
+    if (isPathInside(params.rootCanonicalPath, params.canonicalOutsideLexicalPath)) {
+        return;
+    }
+    throw pathEscapeError({
+        boundaryLabel: params.boundaryLabel,
+        rootPath: params.rootPath,
+        absolutePath: params.absolutePath,
+    });
+}
+function buildResolvedRootPath(params) {
+    return {
+        absolutePath: params.absolutePath,
+        canonicalPath: params.canonicalPath,
+        rootPath: params.rootPath,
+        rootCanonicalPath: params.rootCanonicalPath,
+        relativePath: relativeInsideRoot(params.rootCanonicalPath, params.canonicalPath),
+        exists: params.kind.exists,
+        kind: params.kind.kind,
+    };
+}
+async function getPathKind(absolutePath, preserveFinalSymlink) {
+    try {
+        const stat = preserveFinalSymlink
+            ? fs.lstatSync(absolutePath)
+            : fs.statSync(absolutePath);
+        return { exists: true, kind: toResolvedKind(stat) };
+    }
+    catch (error) {
+        if (isNotFoundPathError(error)) {
+            return { exists: false, kind: "missing" };
+        }
+        throw error;
+    }
+}
+function getPathKindSync(absolutePath, preserveFinalSymlink) {
+    try {
+        const stat = preserveFinalSymlink ? fs.lstatSync(absolutePath) : fs.statSync(absolutePath);
+        return { exists: true, kind: toResolvedKind(stat) };
+    }
+    catch (error) {
+        if (isNotFoundPathError(error)) {
+            return { exists: false, kind: "missing" };
+        }
+        throw error;
+    }
+}
+function toResolvedKind(stat) {
+    if (stat.isFile()) {
+        return "file";
+    }
+    if (stat.isDirectory()) {
+        return "directory";
+    }
+    if (stat.isSymbolicLink()) {
+        return "symlink";
+    }
+    return "other";
+}
+function relativeInsideRoot(rootPath, targetPath) {
+    const relative = path.relative(path.resolve(rootPath), path.resolve(targetPath));
+    if (!relative || relative === ".") {
+        return "";
+    }
+    if (isPathRelativeEscape(relative)) {
+        return "";
+    }
+    return relative;
+}
+function assertInsideBoundary(params) {
+    if (isPathInside(params.rootCanonicalPath, params.candidatePath)) {
+        return;
+    }
+    throw new Error(`Path resolves outside ${params.boundaryLabel} (${shortPath(params.rootCanonicalPath)}): ${shortPath(params.absolutePath)}`);
+}
+function pathEscapeError(params) {
+    return new Error(`Path escapes ${params.boundaryLabel} (${shortPath(params.rootPath)}): ${shortPath(params.absolutePath)}`);
+}
+function symlinkEscapeError(params) {
+    return new Error(`Symlink escapes ${params.boundaryLabel} (${shortPath(params.rootCanonicalPath)}): ${shortPath(params.symlinkPath)}`);
+}