@openclaw/openshell-sandbox 2026.9.3 → 2026.9.5

package/node_modules/@openclaw/fs-safe/dist/opened-file-failure.d.ts

@@ -1,4 +1,4 @@
-import type { BigIntStats } from "node:fs";
+import { type BigIntStats } from "node:fs";
 import type { FileHandle } from "node:fs/promises";
 export declare function recordFileOpenFailure(error: unknown, filePath: string): never;
 export declare function recordExclusiveCreateFailure(error: unknown, filePath: string): never;

package/node_modules/@openclaw/fs-safe/dist/opened-file-failure.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opened-file-failure.d.ts","sourceRoot":"","sources":["../src/opened-file-failure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,KAAK,CAG7E;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,KAAK,CAGpF;AAED,wBAAgB,yBAAyB,CACvC,KAAK,GAAE,KAA8E,GACpF,KAAK,CAGP;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,IAAI,CAAC,CASf"}
+{"version":3,"file":"opened-file-failure.d.ts","sourceRoot":"","sources":["../src/opened-file-failure.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,KAAK,CAG7E;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,KAAK,CAGpF;AAED,wBAAgB,yBAAyB,CACvC,KAAK,GAAE,KAA8E,GACpF,KAAK,CAGP;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,MAAM,EAAE,WAAW,GAAG,SAAS,GAC9B,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,IAAI,CAAC,CASf"}

package/node_modules/@openclaw/fs-safe/dist/opened-file-failure.js

@@ -1,3 +1,4 @@
+import fsSync, {} from "node:fs";
 import { FsSafeError } from "./errors.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
 import { isFileObservationFailure, recordFileObservationFailure } from "./file-observation.js";
@@ -19,7 +20,7 @@ export async function recordPreOpenFileChange(error, handle, filePath, before, o
         return;
     try {
         await inspectFileIdentity(async () => before);
-        const current = await inspectFileIdentity(() => handle.stat({ bigint: true }), opened);
+        const current = await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }), opened);
         if (current.isFile() && [0n, 1n].includes(current.nlink) &&
             (before.dev !== current.dev || before.ino !== current.ino)) {
             // A stale pathname sample is not proof that its former inode was unlinked.
@@ -35,7 +36,7 @@ export async function recordOpenedFileFailure(error, handle, filePath, identity)
         !identity.isFile() || identity.nlink > 1n)
         return;
     try {
-        const current = await inspectFileIdentity(() => handle.stat({ bigint: true }), identity);
+        const current = await inspectFileIdentity(() => fsSync.fstatSync(handle.fd, { bigint: true }), identity);
         if (current.isFile() && current.nlink === 0n)
             recordFileObservationFailure(error, `unlinked:${filePath}`);
     }

package/node_modules/@openclaw/fs-safe/dist/opened-realpath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}
+{"version":3,"file":"opened-realpath.d.ts","sourceRoot":"","sources":["../src/opened-realpath.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,wBAAsB,kCAAkC,CACtD,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EACxC,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC;AACpD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,MAAM,EACV,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,GAAG,WAAW,CAAA;CAAE,CAAC,CAAC"}

package/node_modules/@openclaw/fs-safe/dist/opened-realpath.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { openedPathResolutionError } from "./opened-file-failure.js";
 import { sameFileIdentity } from "./file-identity.js";
 import { isNotFoundPathError } from "./path.js";
+import { realpathSync } from "./realpath.js";
 export async function resolveOpenedFileRealPathForHandle(handle, ioPath) {
     const handleStat = fsSync.fstatSync(handle.fd);
     return (await resolveOpenedFileRealPathForFd(handle.fd, handleStat, ioPath)).realPath;
@@ -16,7 +17,7 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
         : [];
     for (const fdPath of fdCandidates) {
         try {
-            const fdRealPath = fsSync.realpathSync.native(fdPath);
+            const fdRealPath = realpathSync.native(fdPath);
             const fdRealStat = statOptions ? fsSync.statSync(fdRealPath, statOptions) : fsSync.statSync(fdRealPath);
             if (sameFileIdentity(handleStat, fdRealStat)) {
                 return { realPath: fdRealPath, stat: fdRealStat };
@@ -27,7 +28,7 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
         }
     }
     try {
-        const ioRealPath = fsSync.realpathSync.native(ioPath);
+        const ioRealPath = realpathSync.native(ioPath);
         const ioRealStat = statOptions ? fsSync.statSync(ioRealPath, statOptions) : fsSync.statSync(ioRealPath);
         if (sameFileIdentity(handleStat, ioRealStat)) {
             return { realPath: ioRealPath, stat: ioRealStat };
@@ -53,7 +54,7 @@ export async function resolveOpenedFileRealPathForFd(fd, handleStat, ioPath) {
 async function resolveOpenedFileRealPathFromParent(handleStat, ioPath, statOptions) {
     let parentReal;
     try {
-        parentReal = fsSync.realpathSync.native(path.dirname(ioPath));
+        parentReal = realpathSync.native(path.dirname(ioPath));
     }
     catch (err) {
         if (isNotFoundPathError(err)) {
@@ -76,7 +77,7 @@ async function resolveOpenedFileRealPathFromParent(handleStat, ioPath, statOptio
         try {
             const candidateStat = statOptions ? fsSync.lstatSync(candidatePath, statOptions) : fsSync.lstatSync(candidatePath);
             if (candidateStat.isFile() && sameFileIdentity(handleStat, candidateStat)) {
-                const realPath = fsSync.realpathSync.native(candidatePath);
+                const realPath = realpathSync.native(candidatePath);
                 const stat = statOptions ? fsSync.statSync(realPath, statOptions) : fsSync.statSync(realPath);
                 if (sameFileIdentity(handleStat, stat))
                     return { realPath, stat };

package/node_modules/@openclaw/fs-safe/dist/output.d.ts

@@ -5,6 +5,8 @@ export type ExternalFileWriteOptions<T = void> = {
     maxBytes?: number;
     mode?: number;
     staging?: "workspace" | "sibling";
+    /** Isolate sibling producers; workspace staging is already private. */
+    producerIsolation?: "private-directory";
     fallbackFileName?: string;
 };
 export type ExternalFileWriteResult<T = void> = {

package/node_modules/@openclaw/fs-safe/dist/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AAyDF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAgDrC"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAClC,uEAAuE;IACvE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IAAI;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AAyDF,wBAAsB,2BAA2B,CAAC,CAAC,GAAG,IAAI,EACxD,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CA2DrC"}

package/node_modules/@openclaw/fs-safe/dist/output.js

@@ -7,6 +7,7 @@ import { fitFileNameToPortableComponent, sanitizeUntrustedFileName } from "./fil
 import { isPathInside } from "./path.js";
 import { root } from "./root.js";
 import { tempFile } from "./temp-target.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 const NON_PORTABLE_FILE_NAME_CHARACTERS = /[\u0000-\u001f\u007f-\u009f<>:"/\\|?*]/u;
 function tempFileNameForTarget(targetPath, fallbackFileName) {
     const fallback = sanitizeUntrustedFileName(fallbackFileName ?? "output.bin", "output.bin");
@@ -51,8 +52,12 @@ function assertFileTargetPath(targetPath) {
 }
 export async function writeExternalFileWithinRoot(options) {
     const maxBytes = normalizeMaxBytes(options.maxBytes);
-    const targetRoot = await root(options.rootDir);
+    const rootDir = options.rootDir;
+    assertNoWindowsPathAlias(rootDir, "filesystem", "output root uses a Windows filesystem namespace alias");
     const requestedTargetPath = options.path;
+    assertNoWindowsPathAlias(path.dirname(requestedTargetPath), "filesystem", "output target parent uses a Windows filesystem namespace alias");
+    const producerIsolation = options.producerIsolation;
+    const targetRoot = await root(rootDir);
     if (requestedTargetPath.length === 0) {
         throw new FsSafeError("invalid-path", "target path is required");
     }
@@ -64,7 +69,9 @@ export async function writeExternalFileWithinRoot(options) {
     });
     assertFileTargetPath(rawTargetPath);
     const targetPath = sanitizedTargetPath(rawTargetPath, options.fallbackFileName);
+    assertNoWindowsPathAlias(targetPath, "filesystem", "output target uses a Windows filesystem namespace alias");
     const finalPath = await targetRoot.resolve(targetPath);
+    assertNoWindowsPathAlias(finalPath, "filesystem", "output target uses a Windows filesystem namespace alias");
     if (options.staging === "sibling") {
         const parentPath = path.dirname(targetPath);
         if (parentPath !== ".") {
@@ -74,6 +81,7 @@ export async function writeExternalFileWithinRoot(options) {
         const result = await writeExternalFileViaSibling({
             finalPath: siblingFinalPath,
             write: options.write,
+            producerIsolation,
             fallbackFileName: options.fallbackFileName,
             maxBytes,
             mode: options.mode,
@@ -98,7 +106,7 @@ export async function writeExternalFileWithinRoot(options) {
         await staged.cleanup();
     }
 }
-function buildSiblingTempPath(targetPath, fallbackFileName) {
+function buildSiblingTempName(targetPath, fallbackFileName) {
     const prefix = `.fs-safe-output-${process.pid}-${randomUUID()}-`;
     const suffix = ".part";
     const safeTail = fitFileNameToPortableComponent({
@@ -106,13 +114,17 @@ function buildSiblingTempPath(targetPath, fallbackFileName) {
         fileName: tempFileNameForTarget(targetPath, fallbackFileName),
         suffix,
     });
-    return path.join(path.dirname(targetPath), `${prefix}${safeTail}${suffix}`);
+    return `${prefix}${safeTail}${suffix}`;
 }
 async function writeExternalFileViaSibling(params) {
+    assertNoWindowsPathAlias(params.finalPath, "filesystem", "output target uses a Windows filesystem namespace alias");
     const finalPath = path.resolve(params.finalPath);
+    assertNoWindowsPathAlias(finalPath, "filesystem", "output target uses a Windows filesystem namespace alias");
     const { result } = await writeCallbackSibling({
-        tempPath: buildSiblingTempPath(finalPath, params.fallbackFileName),
+        tempDir: path.dirname(finalPath),
+        tempName: buildSiblingTempName(finalPath, params.fallbackFileName),
         write: params.write,
+        producerIsolation: params.producerIsolation,
         resolveFinalPath: () => finalPath,
         mode: params.mode,
         maxBytes: params.maxBytes,

package/node_modules/@openclaw/fs-safe/dist/overwrite-file-handle.d.ts

@@ -0,0 +1,8 @@
+import type { FileHandle } from "node:fs/promises";
+export type OverwriteFileHandleOptions = {
+    /** Admit the whole write once, after rollback preparation and before any mutation. */
+    beforeWrite?: () => void;
+};
+/** Overwrite a borrowed, non-append read/write handle with best-effort failure rollback. */
+export declare function overwriteFileHandle(handle: FileHandle, data: Uint8Array, options?: OverwriteFileHandleOptions): Promise<void>;
+//# sourceMappingURL=overwrite-file-handle.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/overwrite-file-handle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overwrite-file-handle.d.ts","sourceRoot":"","sources":["../src/overwrite-file-handle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMnD,MAAM,MAAM,0BAA0B,GAAG;IACvC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B,CAAC;AAEF,4FAA4F;AAC5F,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,UAAU,EAChB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,IAAI,CAAC,CA2Cf"}

package/node_modules/@openclaw/fs-safe/dist/overwrite-file-handle.js

@@ -0,0 +1,46 @@
+import { FsSafeError } from "./errors.js";
+import { assertSynchronousCallbackResult } from "./mutation-authority.js";
+import { readFileWindowFully } from "./positional-read.js";
+import { writeAllToFile } from "./write-file-handle.js";
+/** Overwrite a borrowed, non-append read/write handle with best-effort failure rollback. */
+export async function overwriteFileHandle(handle, data, options = {}) {
+    // Snapshot caller-owned admission before the first await. Preserve the
+    // former method-call receiver while preventing a later getter mutation from
+    // replacing authority after rollback preparation.
+    const beforeWrite = options.beforeWrite;
+    const payload = data.subarray(0, data.byteLength);
+    const payloadBytes = payload.byteLength;
+    const stat = await handle.stat();
+    if (!stat.isFile()) {
+        throw new FsSafeError("not-file", "overwrite handle must be a regular file");
+    }
+    const originalSize = stat.size;
+    if (!Number.isSafeInteger(originalSize) || originalSize < 0) {
+        throw new RangeError("file size must be a non-negative safe integer");
+    }
+    const prefixBytes = Math.min(payloadBytes, originalSize);
+    const originalPrefix = Buffer.allocUnsafe(prefixBytes);
+    if (await readFileWindowFully(handle, originalPrefix, 0) !== prefixBytes) {
+        throw new FsSafeError("read-failed", "file ended before overwrite rollback preparation completed");
+    }
+    assertSynchronousCallbackResult(beforeWrite === undefined ? undefined : Reflect.apply(beforeWrite, options, []), "beforeWrite");
+    let prefixStarted = false;
+    try {
+        // Leave existing bytes intact until any additional storage has been written.
+        if (payloadBytes > originalSize) {
+            await writeAllToFile(handle, payload.subarray(originalSize), { position: originalSize });
+        }
+        prefixStarted = true;
+        await writeAllToFile(handle, payload.subarray(0, prefixBytes), { position: 0 });
+        if (payloadBytes < originalSize) {
+            await handle.truncate(payloadBytes);
+        }
+    }
+    catch (error) {
+        if (prefixStarted) {
+            await writeAllToFile(handle, originalPrefix, { position: 0 }).catch(() => undefined);
+        }
+        await handle.truncate(originalSize).catch(() => undefined);
+        throw error;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/owner-dacl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"owner-dacl.d.ts","sourceRoot":"","sources":["../src/owner-dacl.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,yBAAyB,EAAE,CAAC;CACnC,GACD;IACE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CA6BvE"}
+{"version":3,"file":"owner-dacl.d.ts","sourceRoot":"","sources":["../src/owner-dacl.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,eAAe,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,yBAAyB,EAAE,CAAC;CACnC,GACD;IACE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,CAAC;AAEN,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,CAmCvE"}

package/node_modules/@openclaw/fs-safe/dist/owner-dacl.js

@@ -1,9 +1,11 @@
 import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export function readOwnerAndDacl(targetPath) {
     if (process.platform !== "win32") {
         return { status: "unsupported-platform", platform: process.platform };
     }
+    assertNoWindowsPathAlias(targetPath, "filesystem", "owner and DACL path uses a Windows filesystem namespace alias");
     const native = getNativeBinding();
     if (!native) {
         throw new FsSafeError("helper-unavailable", "Windows owner and DACL facts require the matching optional native platform package; " +

package/node_modules/@openclaw/fs-safe/dist/path-case.d.ts

@@ -0,0 +1,7 @@
+export type ProbePathCaseOptions = {
+    /** Allow an exclusively created empty probe when existing entries provide no answer. Defaults to true. */
+    allowTemporaryProbe?: boolean;
+};
+/** Observe local ASCII case behavior; unknown observations never imply an operating-system default. */
+export declare function probePathCaseInsensitiveSync(targetPath: string, options?: ProbePathCaseOptions): boolean | undefined;
+//# sourceMappingURL=path-case.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/path-case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-case.d.ts","sourceRoot":"","sources":["../src/path-case.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,oBAAoB,GAAG;IACjC,0GAA0G;IAC1G,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAmFF,uGAAuG;AACvG,wBAAgB,4BAA4B,CAC1C,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,GAAG,SAAS,CAqCrB"}

package/node_modules/@openclaw/fs-safe/dist/path-case.js

@@ -0,0 +1,136 @@
+import { randomUUID } from "node:crypto";
+import fs, {} from "node:fs";
+import path from "node:path";
+import { assertDirectoryIdentitySync, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { sameFileIdentityForCleanup } from "./file-identity.js";
+import { isNotFoundPathError } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { writeTempFileSync } from "./replace-file-descriptor.js";
+import { SyncAtomicTempOwner } from "./replace-file-temp-owner.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+function swapAsciiCase(value) {
+    return value.replace(/[A-Za-z]/g, character => {
+        const lower = character.toLowerCase();
+        return character === lower ? character.toUpperCase() : lower;
+    });
+}
+function probeEntry(directory, name, names) {
+    const alternate = swapAsciiCase(name);
+    if (alternate === name)
+        return undefined;
+    const bothListed = names.has(name) && names.has(alternate);
+    const originalPath = path.join(directory, name);
+    let original;
+    let observed;
+    try {
+        original = inspectFileIdentitySync(() => fs.lstatSync(originalPath, { bigint: true }));
+        try {
+            const other = inspectFileIdentitySync(() => fs.lstatSync(path.join(directory, alternate), { bigint: true }));
+            const sameIdentity = sameFileIdentityForCleanup(original, other);
+            if (sameIdentity || bothListed) {
+                // Matching inodes can belong to newly linked case-distinct names.
+                const currentNames = new Set(fs.readdirSync(directory));
+                const bothCurrent = currentNames.has(name) && currentNames.has(alternate);
+                if (bothListed && !bothCurrent)
+                    return undefined;
+                observed = sameIdentity && !bothCurrent;
+            }
+            else {
+                observed = false;
+            }
+        }
+        catch (error) {
+            if (bothListed || !isNotFoundPathError(error))
+                return undefined;
+            observed = false;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    // Disappearance during lookup is not evidence that case variants are distinct.
+    inspectFileIdentitySync(() => fs.lstatSync(originalPath, { bigint: true }), original);
+    return observed;
+}
+function probeTemporaryEntry(directory) {
+    const name = `.fs-safe-case-probe-${randomUUID()}`;
+    const owner = new SyncAtomicTempOwner(path.join(directory, name));
+    try {
+        owner.start();
+        owner.adopt(writeTempFileSync({
+            fsModule: fs,
+            tempPath: owner.pathname,
+            content: "",
+            mode: 0o600,
+            sync: false,
+            onIdentity: owner.onIdentity,
+        }));
+        owner.assertCurrent(fs);
+        const observed = probeEntry(directory, name, new Set(fs.readdirSync(directory)));
+        owner.assertCurrent(fs);
+        return observed;
+    }
+    finally {
+        // Failed cleanup invalidates the observation; the existing owner retains its exit retry.
+        owner.finish({ fsModule: fs, throwOnCleanupError: true });
+    }
+}
+function probeDirectory(directory, allowTemporaryProbe, preferredName) {
+    const canonical = realpathSync.native(directory);
+    const identity = inspectDirectoryIdentitySync(canonical);
+    const names = new Set(fs.readdirSync(canonical));
+    let observed = preferredName === undefined ? undefined : probeEntry(canonical, preferredName, names);
+    for (const name of names) {
+        if (observed !== undefined)
+            break;
+        observed = probeEntry(canonical, name, names);
+    }
+    if (observed === undefined && allowTemporaryProbe)
+        observed = probeTemporaryEntry(canonical);
+    assertDirectoryIdentitySync(canonical, identity);
+    return realpathSync.native(directory) === canonical ? observed : undefined;
+}
+/** Observe local ASCII case behavior; unknown observations never imply an operating-system default. */
+export function probePathCaseInsensitiveSync(targetPath, options = {}) {
+    const resolved = path.resolve(targetPath);
+    const allowTemporaryProbe = options.allowTemporaryProbe !== false;
+    let targetExists = true;
+    try {
+        fs.lstatSync(resolved);
+    }
+    catch (error) {
+        if (!isNotFoundPathError(error))
+            return undefined;
+        targetExists = false;
+    }
+    if (targetExists) {
+        try {
+            return probeDirectory(path.dirname(resolved), allowTemporaryProbe, path.basename(resolved));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    let directory = path.dirname(resolved);
+    for (;;) {
+        let exists = false;
+        try {
+            exists = fs.statSync(directory).isDirectory();
+        }
+        catch {
+            // A missing or unreadable component can still have a readable existing ancestor.
+        }
+        if (exists) {
+            try {
+                return probeDirectory(directory, allowTemporaryProbe);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory)
+            return undefined;
+        directory = parent;
+    }
+}

package/node_modules/@openclaw/fs-safe/dist/path-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAIxB,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,eAAO,MAAM,mBAAmB;;;;;;;;;CAA2B,CAAC;AAE5D,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBhB"}
+{"version":3,"file":"path-policy.d.ts","sourceRoot":"","sources":["../src/path-policy.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAKxB,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAElD,eAAO,MAAM,mBAAmB;;;;;;;;;CAA2B,CAAC;AAE5D,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBhB;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBhB"}

package/node_modules/@openclaw/fs-safe/dist/path-policy.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import { ROOT_PATH_ALIAS_POLICIES, resolveRootPath, } from "./root-path.js";
 import { isNotFoundPathError } from "./path.js";
 import { shortPath } from "./error-detail.js";
+import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export const PATH_ALIAS_POLICIES = ROOT_PATH_ALIAS_POLICIES;
 export async function assertNoPathAliasEscape(params) {
     const resolved = await resolveRootPath({
@@ -25,9 +26,13 @@ export async function assertNoHardlinkedFinalPath(params) {
     if (params.allowFinalHardlinkForUnlink) {
         return;
     }
+    const filePath = params.filePath;
+    const root = params.root;
+    const boundaryLabel = params.boundaryLabel;
+    assertNoWindowsPathAlias(filePath);
     let stat;
     try {
-        stat = fs.statSync(params.filePath);
+        stat = fs.statSync(filePath);
     }
     catch (err) {
         if (isNotFoundPathError(err)) {
@@ -39,6 +44,6 @@ export async function assertNoHardlinkedFinalPath(params) {
         return;
     }
     if (stat.nlink > 1) {
-        throw new Error(`Hardlinked path is not allowed under ${params.boundaryLabel} (${shortPath(params.root)}): ${shortPath(params.filePath)}`);
+        throw new Error(`Hardlinked path is not allowed under ${boundaryLabel} (${shortPath(root)}): ${shortPath(filePath)}`);
     }
 }

package/node_modules/@openclaw/fs-safe/dist/path-prefix.d.ts

@@ -0,0 +1,7 @@
+export type ResolvedPathPrefix = {
+    readonly absolutePath: string;
+    readonly existingPath: string;
+    readonly unresolvedSegments: readonly string[];
+};
+export declare function resolvePathPrefixSync(input: string): ResolvedPathPrefix;
+//# sourceMappingURL=path-prefix.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/path-prefix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-prefix.d.ts","sourceRoot":"","sources":["../src/path-prefix.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD,CAAC;AAkBF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAsDvE"}

package/node_modules/@openclaw/fs-safe/dist/path-prefix.js

@@ -0,0 +1,82 @@
+import fs from "node:fs";
+import path from "node:path";
+import { formatErrorDetail } from "./error-detail.js";
+import { assertNoNulPathInput, hasNodeErrorCode } from "./path.js";
+import { realpathSync } from "./realpath.js";
+import { absolutePathWithRawSegments } from "./root-path-existing.js";
+import { pathForWindowsFilesystem } from "./windows-path-alias.js";
+function rawRoot(absolutePath) {
+    if (path.sep === "\\" && /^\\\\[?.]\\UNC\\/i.test(absolutePath)) {
+        // Node parses only the namespace prefix as the root of an extended UNC path.
+        const shareRoot = path.parse(`\\\\${absolutePath.slice(8)}`).root;
+        return absolutePath.slice(0, shareRoot.length + 6);
+    }
+    return path.parse(absolutePath).root;
+}
+function resolutionError(code, absolutePath) {
+    const detail = code === "ELOOP" ? "too many symbolic links" : "not a directory";
+    return Object.assign(new Error(`${code}: ${detail}, resolvePathPrefix ${formatErrorDetail(absolutePath)}`), {
+        code, syscall: "resolvePathPrefix", path: absolutePath,
+    });
+}
+export function resolvePathPrefixSync(input) {
+    assertNoNulPathInput(input);
+    const absolutePath = absolutePathWithRawSegments(input);
+    let resolved = rawRoot(absolutePath);
+    const remaining = absolutePath.slice(resolved.length).split(path.sep);
+    const visitedStates = new Set();
+    let symlinkHops = 0;
+    while (remaining.length > 0) {
+        const segment = remaining.shift();
+        if (segment === "")
+            continue;
+        if (segment === "." || segment === "..") {
+            const atRoot = resolved === rawRoot(resolved);
+            const lookup = segment === ".." && atRoot ? "." : segment;
+            // lstat(dir) does not test search permission, and realpath may erase dots.
+            const operationBase = pathForWindowsFilesystem(resolved);
+            fs.lstatSync(`${operationBase}${operationBase.endsWith(path.sep) ? "" : path.sep}${lookup}`, { bigint: true });
+            if (segment === ".." && !atRoot)
+                resolved = path.dirname(resolved);
+            continue;
+        }
+        const candidate = path.join(resolved, segment);
+        let stat;
+        try {
+            stat = fs.lstatSync(candidate, { bigint: true });
+        }
+        catch (error) {
+            if (!hasNodeErrorCode(error, "ENOENT"))
+                throw error;
+            return {
+                absolutePath,
+                existingPath: realpathSync.native(pathForWindowsFilesystem(resolved)),
+                unresolvedSegments: [segment, ...remaining],
+            };
+        }
+        if (!stat.isSymbolicLink()) {
+            if (!stat.isDirectory() && remaining.length > 0)
+                throw resolutionError("ENOTDIR", absolutePath);
+            resolved = candidate;
+            continue;
+        }
+        const state = JSON.stringify([String(stat.dev), String(stat.ino), candidate, remaining]);
+        if (symlinkHops >= 64 || visitedStates.has(state))
+            throw resolutionError("ELOOP", absolutePath);
+        visitedStates.add(state);
+        symlinkHops++;
+        const target = fs.readlinkSync(candidate);
+        const rawTarget = path.sep === "\\" ? target.replaceAll("/", "\\") : target;
+        if (path.isAbsolute(rawTarget)) {
+            const targetRoot = rawRoot(rawTarget);
+            // A rooted Windows link target uses the link's drive/share, not cwd's.
+            resolved = path.sep === "\\" && targetRoot === "\\" ? rawRoot(resolved) : targetRoot;
+            remaining.unshift(...rawTarget.slice(targetRoot.length).split(path.sep));
+        }
+        else {
+            // A target's parent traversal applies after resolving its preceding links.
+            remaining.unshift(...rawTarget.split(path.sep));
+        }
+    }
+    return { absolutePath, existingPath: realpathSync.native(pathForWindowsFilesystem(resolved)), unresolvedSegments: [] };
+}

package/node_modules/@openclaw/fs-safe/dist/path-scope-lexical.d.ts

@@ -0,0 +1,14 @@
+export type ResolvePathWithinRootParams = {
+    rootDir: string;
+    requestedPath: string;
+    scopeLabel: string;
+    defaultFileName?: string;
+};
+export declare function resolvePathWithinNormalizedRoot(params: ResolvePathWithinRootParams, root: string): {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=path-scope-lexical.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/path-scope-lexical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-scope-lexical.d.ts","sourceRoot":"","sources":["../src/path-scope-lexical.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAUF,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,2BAA2B,EACnC,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA4B3D"}

package/node_modules/@openclaw/fs-safe/dist/path-scope-lexical.js

@@ -0,0 +1,37 @@
+import path from "node:path";
+import { isPathInside, isPathRelativeEscape } from "./path.js";
+import { hasWindowsPathAlias, resolvePathFromBasePreservingWindowsRoot } from "./windows-path-alias.js";
+function pathStaysWithinRoot(rootDir, candidatePath) {
+    if (process.platform !== "win32") {
+        return candidatePath !== rootDir && isPathInside(rootDir, candidatePath);
+    }
+    const relative = path.relative(rootDir, candidatePath);
+    return Boolean(relative) && !isPathRelativeEscape(relative);
+}
+export function resolvePathWithinNormalizedRoot(params, root) {
+    const requestedPath = params.requestedPath;
+    const defaultFileName = params.defaultFileName;
+    const scopeLabel = params.scopeLabel;
+    if (hasWindowsPathAlias(params.rootDir, "filesystem") ||
+        hasWindowsPathAlias(root, "filesystem") ||
+        hasWindowsPathAlias(requestedPath, "filesystem") ||
+        (defaultFileName !== undefined && hasWindowsPathAlias(defaultFileName, "filesystem"))) {
+        return { ok: false, error: `Invalid path: must stay within ${scopeLabel}` };
+    }
+    const raw = requestedPath.trim();
+    if (!raw) {
+        if (!defaultFileName) {
+            return { ok: false, error: "path is required" };
+        }
+        const defaultPath = resolvePathFromBasePreservingWindowsRoot(root, defaultFileName);
+        if (hasWindowsPathAlias(defaultPath, "filesystem") || !pathStaysWithinRoot(root, defaultPath)) {
+            return { ok: false, error: `Invalid path: must stay within ${scopeLabel}` };
+        }
+        return { ok: true, path: defaultPath };
+    }
+    const resolved = resolvePathFromBasePreservingWindowsRoot(root, raw);
+    if (hasWindowsPathAlias(resolved, "filesystem") || !pathStaysWithinRoot(root, resolved)) {
+        return { ok: false, error: `Invalid path: must stay within ${scopeLabel}` };
+    }
+    return { ok: true, path: resolved };
+}

package/node_modules/@openclaw/fs-safe/dist/path-segment-route.d.ts

@@ -0,0 +1,7 @@
+export type PathSegmentRoute = Readonly<{
+    joined: string;
+    offsets: readonly number[];
+}>;
+export declare function createPathSegmentRoute(segments: readonly string[]): PathSegmentRoute;
+export declare function joinPathSegmentRoute(base: string, route: PathSegmentRoute, offset: number, tail?: string): string;
+//# sourceMappingURL=path-segment-route.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/path-segment-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-segment-route.d.ts","sourceRoot":"","sources":["../src/path-segment-route.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAUpF;AAID,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAMR"}

package/node_modules/@openclaw/fs-safe/dist/path-segment-route.js

@@ -0,0 +1,24 @@
+import path from "node:path";
+export function createPathSegmentRoute(segments) {
+    const offsets = new Array(segments.length + 1);
+    let cursor = 0;
+    for (let index = 0; index < segments.length; index += 1) {
+        offsets[index] = cursor;
+        cursor += segments[index].length;
+        if (index + 1 < segments.length)
+            cursor += path.sep.length;
+    }
+    offsets[segments.length] = cursor;
+    return Object.freeze({ joined: segments.join(path.sep), offsets: Object.freeze(offsets) });
+}
+// Select the immutable suffix by character offset so callers perform at most
+// one path normalization without copying a shrinking segment array.
+export function joinPathSegmentRoute(base, route, offset, tail) {
+    const start = route.offsets[offset];
+    if (start === undefined)
+        throw new RangeError("path segment offset is outside the route");
+    const suffix = route.joined.slice(start);
+    if (suffix)
+        return tail === undefined ? path.join(base, suffix) : path.join(base, suffix, tail);
+    return tail === undefined ? base : path.join(base, tail);
+}