@vibe-agent-toolkit/utils 0.2.0-rc.7 → 0.2.0-rc.9

package/dist/path-containment.js

@@ -0,0 +1,111 @@
+/**
+ * `isUnderRoot` — the containment question a SINK asks.
+ *
+ * A delete, a copy, an uninstall: each takes a path that somebody else spelled
+ * (a manifest's `name:`, a `flatSkills` entry, a positional the user typed) and
+ * is about to act on `join(root, that)`. The question is whether the action
+ * lands inside the root, and the only honest answer comes from the
+ * filesystem: `startsWith('..')` on a lexical `relative()` misses a symlink
+ * inside the root that points out, refuses a member named `..cache`, and is
+ * blind to a drive letter — the sweep behind this module watched all three
+ * happen at exit 0.
+ *
+ * Both sides are canonicalized the same way, through the deepest existing
+ * ancestor, so a root reached through a symlink (macOS `/tmp`, a linked
+ * `~/.claude`) still contains its members, and a candidate that does not exist
+ * yet is judged by where creating it would land. Absence is reported as its
+ * own answer rather than folded into either side, because a delete sink and a
+ * create sink want opposite things from it.
+ *
+ * Lexical classification of an already-relative path — a projection identity,
+ * a report relativizer — is a different question with a different helper:
+ * `relativeEscapesRoot` in `path-core.ts`, which touches no filesystem.
+ */
+import { lstatSync } from 'node:fs';
+import path from 'node:path';
+import { isPathAbsentError } from './errors/errno.js';
+import { normalizePath, safePath, toForwardSlash } from './path-utils.js';
+/**
+ * The canonical spelling of `target`, from its deepest existing ancestor.
+ *
+ * Walks up until `lstat` answers, canonicalizes THAT with the same realpath
+ * every path helper uses, and re-appends the missing tail. A refusal is not
+ * an absence: `EACCES` on an ancestor, `ELOOP` on a cycle, an invalid name —
+ * the OS is saying it cannot examine the path, and a containment verdict
+ * built on the spelling it refused is the bug this module exists to remove.
+ * Those stay loud.
+ *
+ * `lstat` rather than `stat`, so a dangling symlink counts as existing: it is
+ * an entry the sink can act on (a delete removes the link), and its realpath
+ * failing is answered by {@link normalizePath} with the lexical spelling, which
+ * is where the entry is.
+ */
+function canonicalFromAncestor(target) {
+    const absolute = safePath.resolve(target);
+    const missing = [];
+    let candidate = absolute;
+    for (;;) {
+        if (entryExists(candidate)) {
+            return {
+                canonical: safePath.join(toForwardSlash(normalizePath(candidate)), ...missing),
+                exists: missing.length === 0,
+            };
+        }
+        const parent = toForwardSlash(path.dirname(candidate));
+        // Fixpoint at a filesystem root: `dirname` returns its own input, nothing
+        // on the path resolved, and the lexical form is the only answer there is.
+        if (parent === candidate) {
+            return { canonical: absolute, exists: false };
+        }
+        missing.unshift(path.basename(candidate));
+        candidate = parent;
+    }
+}
+/** Whether an entry (a file, a directory, or a link — dangling or not) is at `p`. */
+function entryExists(p) {
+    try {
+        lstatSync(p);
+        return true;
+    }
+    catch (error) {
+        if (isPathAbsentError(error))
+            return false;
+        throw error;
+    }
+}
+/**
+ * Is `candidate` strictly under `root`, as the filesystem judges it?
+ *
+ * Both paths may be relative (resolved from cwd) or absolute, in either
+ * separator; neither has to exist. See {@link Containment} for the three
+ * answers and which sinks accept which.
+ *
+ * ⚠️ Costs one `lstat` per missing component plus two `realpath`s. That is
+ * nothing for a sink — a delete or a copy dwarfs it — and too much for a loop
+ * over every link in a corpus, which is why the projection and link lanes
+ * classify lexically with `relativeEscapesRoot` and never call this.
+ *
+ * @param root - The directory the action must stay inside
+ * @param candidate - The path the action is about to touch
+ * @returns `'inside'`, `'outside'`, or `'absent'`
+ * @throws When the OS refuses to examine either path for any reason but
+ *   absence — a refusal is reported, never read as "not there"
+ *
+ * @example
+ * // A delete sink: only an existing, contained target may go.
+ * if (isUnderRoot(skillsDir, target) !== 'inside') throw new Error(`refusing to remove ${target}: not inside ${skillsDir}`);
+ * await rm(target, { recursive: true, force: true });
+ *
+ * // A create sink: absent-but-contained is exactly the happy path.
+ * if (isUnderRoot(skillsDir, dest) === 'outside') throw new Error(`refusing to install to ${dest}: not inside ${skillsDir}`);
+ */
+export function isUnderRoot(root, candidate) {
+    const rootReal = canonicalFromAncestor(root).canonical;
+    const target = canonicalFromAncestor(candidate);
+    const prefix = rootReal.endsWith('/') ? rootReal : `${rootReal}/`;
+    if (!target.canonical.startsWith(prefix)) {
+        return 'outside';
+    }
+    return target.exists ? 'inside' : 'absent';
+}
+//# sourceMappingURL=path-containment.js.map

package/dist/path-containment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-containment.js","sourceRoot":"","sources":["../src/path-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAgB1E;;;;;;;;;;;;;;GAcG;AACH,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,SAAS,CAAC;QACR,IAAI,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC;gBAC9E,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;aAC7B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC;QACH,SAAS,CAAC,CAAC,CAAC,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IACzD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;IACvD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7C,CAAC"}

package/dist/path-core.d.ts

@@ -10,6 +10,26 @@
  * `mkdirSyncReal`, `resolveFromImportMeta`, `dynamicImportPath`) live in
  * `./path-utils.ts` and are exposed via the `./fs` entry.
  */
+import { VatError } from './errors/vat-error.js';
+/**
+ * Thrown by {@link safePath.joinUnderRoot} when the joined path would land
+ * outside its root.
+ *
+ * A class with a code rather than a prefixed sentence: three packages used to
+ * recognise this refusal with `error.message.startsWith('safePath.joinUnderRoot:')`,
+ * which is a contract on prose. Dispatch with
+ * `isVatError(error, PathEscapesRootError.code)` — it survives the `src`/`dist`
+ * boundary that `instanceof` does not.
+ */
+export declare class PathEscapesRootError extends VatError {
+    /** The code every instance carries, for `isVatError(error, PathEscapesRootError.code)`. */
+    static readonly code = "PATH_ESCAPES_ROOT";
+    /**
+     * @param root - The root the path had to stay under
+     * @param detail - Which segment, or which result, escaped it
+     */
+    constructor(root: string, detail: string);
+}
 /**
  * Check if a path is absolute
  *
@@ -44,8 +64,9 @@ export declare function isAbsoluteAnyPlatform(p: string): boolean;
 /**
  * True if `p` contains a `..` parent-directory traversal segment.
  *
- * Forward-slash-normalized, then inspects each `/`-delimited segment — so a
- * `..` is caught regardless of the original OS separator. A containment guard
+ * Backslashes are read as separators on every host (the input is author-written
+ * config), then each `/`-delimited segment is inspected — so a `..` is caught
+ * regardless of the separator the author typed. A containment guard
  * for config-supplied relative paths (skill `files:` dest values, glob magic
  * remainders) that must never climb above their anchor directory.
  *
@@ -56,6 +77,59 @@ export declare function isAbsoluteAnyPlatform(p: string): boolean;
  * hasParentTraversalSegment('a..b/c')      // false (".." must be a whole segment)
  */
 export declare function hasParentTraversalSegment(p: string): boolean;
+/**
+ * True when a root-relative path — as `safePath.relative(root, p)` spells it —
+ * names something the root does not contain.
+ *
+ * The three shapes `path.relative` can return for an outsider: the parent
+ * itself (`..`), a climb through it (`../x`), and, on Windows only, an
+ * absolute path (a target on another drive has no relative spelling). A name
+ * that merely BEGINS with two dots (`..notes.md`) is a member and reads as one;
+ * the bare `startsWith('..')` this replaces refused it, dropped the file from
+ * the package and unlinked the reference, at exit 0.
+ *
+ * ⚠️ **Lexical, on purpose.** This classifies a relative path that was already
+ * computed; it does not ask the filesystem, so a symlink inside the root that
+ * points outside reads as inside here. That is the right answer for the
+ * callers that own no root to ask about — a projection identity, a permission
+ * pattern, a report relativizer — and the WRONG one for a delete or copy sink,
+ * which must ask {@link isUnderRoot} from `@vibe-agent-toolkit/utils` instead.
+ * The empty relative (the root itself) is not an escape; whether equality is
+ * acceptable is the caller's question and is asked beside this one.
+ *
+ * @param normalizedRelative - A forward-slashed root-relative path
+ * @returns True when the root does not contain it
+ *
+ * @example
+ * relativeEscapesRoot(safePath.relative(root, p))   // the whole idiom
+ * relativeEscapesRoot('../x')       // true
+ * relativeEscapesRoot('..notes.md') // false — a member whose name starts with dots
+ */
+export declare function relativeEscapesRoot(normalizedRelative: string): boolean;
+/**
+ * True when `name` can only ever be ONE directory entry under whatever it is
+ * joined to: non-empty, not `.` or `..`, no separator of either platform, no
+ * NUL, no drive-letter prefix.
+ *
+ * The check for a caller-controlled NAME — a skill name from a manifest, a
+ * session id, a positional the user typed — that is about to become
+ * `join(root, name)`. A name is not a path: `..cache` and `a..b` are legitimate
+ * entries, and `includes('..')` refused them while `startsWith` let `x/../..`
+ * through. The question is whether the join can land anywhere but directly
+ * under `root`, and that is answered by the segment's shape alone, with no
+ * filesystem — which is also why this belongs beside the path helpers rather
+ * than beside {@link isUnderRoot}, which is the check for a PATH.
+ *
+ * @param name - The proposed entry name
+ * @returns True when `join(root, name)` is a direct child of `root`
+ *
+ * @example
+ * isSingleFsSegment('my-skill')   // true
+ * isSingleFsSegment('..cache')    // true — dots inside a name are just dots
+ * isSingleFsSegment('../victim')  // false
+ * isSingleFsSegment('..')         // false
+ */
+export declare function isSingleFsSegment(name: string): boolean;
 /**
  * Compute a `ValidationIssue.location`: an absolute source file path made
  * relative to the scan/project root, forward-slashed.
@@ -115,23 +189,42 @@ export declare function toAbsolutePath(p: string, baseDir: string): string;
  */
 export declare function getRelativePath(from: string, to: string): string;
 /**
- * Convert a path to forward slashes
+ * Convert a NATIVE path — one the filesystem, `path.*`, `readdir` or git
+ * handed you — to forward slashes.
  *
- * Windows accepts both forward slashes and backslashes as path separators.
- * This function normalizes all paths to use forward slashes for consistency.
- * Useful for glob pattern matching, cross-platform comparisons, and string operations.
+ * Converts only where a backslash is a separator (win32). On POSIX a backslash is a
+ * legal filename character, so `docs/x\y.md` is one file and is returned
+ * unchanged: converting it would invent a phantom `docs/x/` directory and, in
+ * {@link safePath.joinUnderRoot}, turn an `x\..\..` NAME into a climb.
  *
- * @param p - Path to convert
- * @returns Path with forward slashes
+ * For AUTHOR-WRITTEN text — an href, a glob, a config value, a CLI argument,
+ * an archive entry name — whose backslashes must read as separators on every
+ * host, use {@link toForwardSlashAnyPlatform}.
  *
- * @example
- * toForwardSlash('C:\\Users\\docs\\README.md')
- * // Returns: 'C:/Users/docs/README.md'
+ * @param p - A native path
+ * @returns The path with forward slashes (identity on POSIX)
  *
- * toForwardSlash('/project/docs/README.md')
- * // Returns: '/project/docs/README.md' (unchanged)
+ * @example
+ * toForwardSlash('C:\\Users\\docs\\README.md') // win32: 'C:/Users/docs/README.md'
+ * toForwardSlash('docs/x\\y.md')                // POSIX: 'docs/x\\y.md' (unchanged)
  */
 export declare function toForwardSlash(p: string): string;
+/**
+ * Convert every backslash to a forward slash, on every host.
+ *
+ * For AUTHOR-WRITTEN text that may carry Windows spellings regardless of where
+ * VAT runs — markdown hrefs, globs, config values, CLI arguments, zip entry
+ * names — and for containment guards that must refuse `..\x` everywhere.
+ * Never use it on a path read from the filesystem or git: on POSIX that
+ * backslash is part of a filename. Use {@link toForwardSlash} for those.
+ *
+ * @param text - Author-written path text
+ * @returns The text with every backslash replaced by `/`
+ *
+ * @example
+ * toForwardSlashAnyPlatform('..\\evil')   // '../evil' on every host
+ */
+export declare function toForwardSlashAnyPlatform(text: string): string;
 /**
  * Normalize text to Unicode NFC — the form in which two *visually identical*
  * filenames compare equal.
@@ -166,12 +259,14 @@ export declare function toNfc(value: string): string;
  * Cross-platform safe path operations.
  *
  * Wraps Node's `path.join()`, `path.resolve()`, and `path.relative()` to always
- * return forward-slash paths. On Windows, the native `path.*` functions return
+ * return forward-slash paths (converted through {@link toForwardSlash}, so a
+ * backslash inside a POSIX filename survives). On Windows, the native `path.*` functions return
  * backslashes, which causes bugs when paths are used as Map keys, compared as
  * strings, or matched with glob patterns.
  *
  * **Use these instead of importing from `node:path` directly.**
- * ESLint rules enforce this — see `no-path-join`, `no-path-resolve`, `no-path-relative`.
+ * An ESLint rule enforces this — see `no-raw-node-path` (its `functions` option
+ * table maps each of `join`/`resolve`/`relative` to its `safePath.*` replacement).
  *
  * @example
  * ```typescript
@@ -182,7 +277,7 @@ export declare function toNfc(value: string): string;
  * safePath.resolve('/project', './docs')                   // → '/project/docs'
  * safePath.relative('/project/docs', '/project')           // → '..'
  * safePath.joinUnderRoot('/harness', 'skill-abc')          // → '/harness/skill-abc'
- * safePath.joinUnderRoot('/harness', '../escape')          // throws Error
+ * safePath.joinUnderRoot('/harness', '../escape')          // throws PathEscapesRootError
  * ```
  */
 export declare const safePath: {
@@ -210,7 +305,7 @@ export declare const safePath: {
      * skill-test staging code was vulnerable to on Windows.
      *
      * @returns Forward-slash absolute path guaranteed to be inside `root`.
-     * @throws {Error} If the resolved path would escape `root`.
+     * @throws {PathEscapesRootError} If the resolved path would escape `root`.
      *
      * @example
      * ```typescript

package/dist/path-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-core.d.ts","sourceRoot":"","sources":["../src/path-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,QAAQ;IACnB,6DAA6D;8BAC9C,MAAM,EAAE,KAAG,MAAM;IAIhC,gEAAgE;iCAC9C,MAAM,EAAE,KAAG,MAAM;IAInC,iEAAiE;8BAClD,MAAM,MAAM,MAAM,KAAG,MAAM;IAI1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;mCACiB,MAAM,eAAe,MAAM,EAAE,KAAG,MAAM;CAuClD,CAAC"}
+{"version":3,"file":"path-core.d.ts","sourceRoot":"","sources":["../src/path-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ;IAChD,2FAA2F;IAC3F,MAAM,CAAC,QAAQ,CAAC,IAAI,uBAAuB;IAE3C;;;OAGG;gBACS,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAGzC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,mBAAmB,CAAC,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAGvE;AAKD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAMhE;AAKD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,QAAQ;IACnB,6DAA6D;8BAC9C,MAAM,EAAE,KAAG,MAAM;IAIhC,gEAAgE;iCAC9C,MAAM,EAAE,KAAG,MAAM;IAInC,iEAAiE;8BAClD,MAAM,MAAM,MAAM,KAAG,MAAM;IAI1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;mCACiB,MAAM,eAAe,MAAM,EAAE,KAAG,MAAM;CAiClD,CAAC"}

package/dist/path-core.js

@@ -11,6 +11,28 @@
  * `./path-utils.ts` and are exposed via the `./fs` entry.
  */
 import path from 'node:path';
+import { VatError } from './errors/vat-error.js';
+/**
+ * Thrown by {@link safePath.joinUnderRoot} when the joined path would land
+ * outside its root.
+ *
+ * A class with a code rather than a prefixed sentence: three packages used to
+ * recognise this refusal with `error.message.startsWith('safePath.joinUnderRoot:')`,
+ * which is a contract on prose. Dispatch with
+ * `isVatError(error, PathEscapesRootError.code)` — it survives the `src`/`dist`
+ * boundary that `instanceof` does not.
+ */
+export class PathEscapesRootError extends VatError {
+    /** The code every instance carries, for `isVatError(error, PathEscapesRootError.code)`. */
+    static code = 'PATH_ESCAPES_ROOT';
+    /**
+     * @param root - The root the path had to stay under
+     * @param detail - Which segment, or which result, escaped it
+     */
+    constructor(root, detail) {
+        super(PathEscapesRootError.code, `safePath.joinUnderRoot: ${detail} escapes root "${root}".`);
+    }
+}
 /**
  * Check if a path is absolute
  *
@@ -49,8 +71,9 @@ export function isAbsoluteAnyPlatform(p) {
 /**
  * True if `p` contains a `..` parent-directory traversal segment.
  *
- * Forward-slash-normalized, then inspects each `/`-delimited segment — so a
- * `..` is caught regardless of the original OS separator. A containment guard
+ * Backslashes are read as separators on every host (the input is author-written
+ * config), then each `/`-delimited segment is inspected — so a `..` is caught
+ * regardless of the separator the author typed. A containment guard
  * for config-supplied relative paths (skill `files:` dest values, glob magic
  * remainders) that must never climb above their anchor directory.
  *
@@ -61,7 +84,74 @@ export function isAbsoluteAnyPlatform(p) {
  * hasParentTraversalSegment('a..b/c')      // false (".." must be a whole segment)
  */
 export function hasParentTraversalSegment(p) {
-    return toForwardSlash(p).split('/').includes('..');
+    // eslint-disable-next-line local/no-dotdot-containment -- this IS the one lexical `..`-segment test the rule points to; it classifies a config-supplied RELATIVE spelling before any root exists to ask the filesystem about. Sinks use isUnderRoot().
+    return toForwardSlashAnyPlatform(p).split('/').includes('..');
+}
+/**
+ * True when a root-relative path — as `safePath.relative(root, p)` spells it —
+ * names something the root does not contain.
+ *
+ * The three shapes `path.relative` can return for an outsider: the parent
+ * itself (`..`), a climb through it (`../x`), and, on Windows only, an
+ * absolute path (a target on another drive has no relative spelling). A name
+ * that merely BEGINS with two dots (`..notes.md`) is a member and reads as one;
+ * the bare `startsWith('..')` this replaces refused it, dropped the file from
+ * the package and unlinked the reference, at exit 0.
+ *
+ * ⚠️ **Lexical, on purpose.** This classifies a relative path that was already
+ * computed; it does not ask the filesystem, so a symlink inside the root that
+ * points outside reads as inside here. That is the right answer for the
+ * callers that own no root to ask about — a projection identity, a permission
+ * pattern, a report relativizer — and the WRONG one for a delete or copy sink,
+ * which must ask {@link isUnderRoot} from `@vibe-agent-toolkit/utils` instead.
+ * The empty relative (the root itself) is not an escape; whether equality is
+ * acceptable is the caller's question and is asked beside this one.
+ *
+ * @param normalizedRelative - A forward-slashed root-relative path
+ * @returns True when the root does not contain it
+ *
+ * @example
+ * relativeEscapesRoot(safePath.relative(root, p))   // the whole idiom
+ * relativeEscapesRoot('../x')       // true
+ * relativeEscapesRoot('..notes.md') // false — a member whose name starts with dots
+ */
+export function relativeEscapesRoot(normalizedRelative) {
+    // eslint-disable-next-line local/no-dotdot-containment -- this IS the one lexical relative-path classifier the rule points to; every former copy of this pair now calls here. Sinks use isUnderRoot().
+    return normalizedRelative === '..' || normalizedRelative.startsWith('../') || isAbsoluteAnyPlatform(normalizedRelative);
+}
+/** A Windows drive-relative spelling (`C:`) — `path.resolve` sends it to that drive's cwd. */
+const DRIVE_RELATIVE = /^[A-Za-z]:/u;
+/**
+ * True when `name` can only ever be ONE directory entry under whatever it is
+ * joined to: non-empty, not `.` or `..`, no separator of either platform, no
+ * NUL, no drive-letter prefix.
+ *
+ * The check for a caller-controlled NAME — a skill name from a manifest, a
+ * session id, a positional the user typed — that is about to become
+ * `join(root, name)`. A name is not a path: `..cache` and `a..b` are legitimate
+ * entries, and `includes('..')` refused them while `startsWith` let `x/../..`
+ * through. The question is whether the join can land anywhere but directly
+ * under `root`, and that is answered by the segment's shape alone, with no
+ * filesystem — which is also why this belongs beside the path helpers rather
+ * than beside {@link isUnderRoot}, which is the check for a PATH.
+ *
+ * @param name - The proposed entry name
+ * @returns True when `join(root, name)` is a direct child of `root`
+ *
+ * @example
+ * isSingleFsSegment('my-skill')   // true
+ * isSingleFsSegment('..cache')    // true — dots inside a name are just dots
+ * isSingleFsSegment('../victim')  // false
+ * isSingleFsSegment('..')         // false
+ */
+export function isSingleFsSegment(name) {
+    return (name !== '' &&
+        name !== '.' &&
+        name !== '..' &&
+        !name.includes('/') &&
+        !name.includes('\\') &&
+        !name.includes('\0') &&
+        !DRIVE_RELATIVE.test(name));
 }
 /**
  * Compute a `ValidationIssue.location`: an absolute source file path made
@@ -133,25 +223,49 @@ export function getRelativePath(from, to) {
     // Calculate relative path from source directory to target file
     return toForwardSlash(path.relative(fromDir, to));
 }
+/** True on hosts (win32) where a backslash is a path separator; everywhere else it is a filename character. */
+const BACKSLASH_IS_NATIVE_SEPARATOR = path.sep === '\\';
 /**
- * Convert a path to forward slashes
+ * Convert a NATIVE path — one the filesystem, `path.*`, `readdir` or git
+ * handed you — to forward slashes.
  *
- * Windows accepts both forward slashes and backslashes as path separators.
- * This function normalizes all paths to use forward slashes for consistency.
- * Useful for glob pattern matching, cross-platform comparisons, and string operations.
+ * Converts only where a backslash is a separator (win32). On POSIX a backslash is a
+ * legal filename character, so `docs/x\y.md` is one file and is returned
+ * unchanged: converting it would invent a phantom `docs/x/` directory and, in
+ * {@link safePath.joinUnderRoot}, turn an `x\..\..` NAME into a climb.
  *
- * @param p - Path to convert
- * @returns Path with forward slashes
+ * For AUTHOR-WRITTEN text — an href, a glob, a config value, a CLI argument,
+ * an archive entry name — whose backslashes must read as separators on every
+ * host, use {@link toForwardSlashAnyPlatform}.
  *
- * @example
- * toForwardSlash('C:\\Users\\docs\\README.md')
- * // Returns: 'C:/Users/docs/README.md'
+ * @param p - A native path
+ * @returns The path with forward slashes (identity on POSIX)
  *
- * toForwardSlash('/project/docs/README.md')
- * // Returns: '/project/docs/README.md' (unchanged)
+ * @example
+ * toForwardSlash('C:\\Users\\docs\\README.md') // win32: 'C:/Users/docs/README.md'
+ * toForwardSlash('docs/x\\y.md')                // POSIX: 'docs/x\\y.md' (unchanged)
  */
 export function toForwardSlash(p) {
-    return p.replaceAll('\\', '/');
+    return BACKSLASH_IS_NATIVE_SEPARATOR ? toForwardSlashAnyPlatform(p) : p;
+}
+/**
+ * Convert every backslash to a forward slash, on every host.
+ *
+ * For AUTHOR-WRITTEN text that may carry Windows spellings regardless of where
+ * VAT runs — markdown hrefs, globs, config values, CLI arguments, zip entry
+ * names — and for containment guards that must refuse `..\x` everywhere.
+ * Never use it on a path read from the filesystem or git: on POSIX that
+ * backslash is part of a filename. Use {@link toForwardSlash} for those.
+ *
+ * @param text - Author-written path text
+ * @returns The text with every backslash replaced by `/`
+ *
+ * @example
+ * toForwardSlashAnyPlatform('..\\evil')   // '../evil' on every host
+ */
+export function toForwardSlashAnyPlatform(text) {
+    // eslint-disable-next-line local/no-manual-path-normalize -- this IS the converter the rule's autofix writes; it cannot call itself.
+    return text.replaceAll('\\', '/');
 }
 /**
  * Normalize text to Unicode NFC — the form in which two *visually identical*
@@ -189,12 +303,14 @@ export function toNfc(value) {
  * Cross-platform safe path operations.
  *
  * Wraps Node's `path.join()`, `path.resolve()`, and `path.relative()` to always
- * return forward-slash paths. On Windows, the native `path.*` functions return
+ * return forward-slash paths (converted through {@link toForwardSlash}, so a
+ * backslash inside a POSIX filename survives). On Windows, the native `path.*` functions return
  * backslashes, which causes bugs when paths are used as Map keys, compared as
  * strings, or matched with glob patterns.
  *
  * **Use these instead of importing from `node:path` directly.**
- * ESLint rules enforce this — see `no-path-join`, `no-path-resolve`, `no-path-relative`.
+ * An ESLint rule enforces this — see `no-raw-node-path` (its `functions` option
+ * table maps each of `join`/`resolve`/`relative` to its `safePath.*` replacement).
  *
  * @example
  * ```typescript
@@ -205,7 +321,7 @@ export function toNfc(value) {
  * safePath.resolve('/project', './docs')                   // → '/project/docs'
  * safePath.relative('/project/docs', '/project')           // → '..'
  * safePath.joinUnderRoot('/harness', 'skill-abc')          // → '/harness/skill-abc'
- * safePath.joinUnderRoot('/harness', '../escape')          // throws Error
+ * safePath.joinUnderRoot('/harness', '../escape')          // throws PathEscapesRootError
  * ```
  */
 export const safePath = {
@@ -239,7 +355,7 @@ export const safePath = {
      * skill-test staging code was vulnerable to on Windows.
      *
      * @returns Forward-slash absolute path guaranteed to be inside `root`.
-     * @throws {Error} If the resolved path would escape `root`.
+     * @throws {PathEscapesRootError} If the resolved path would escape `root`.
      *
      * @example
      * ```typescript
@@ -255,12 +371,12 @@ export const safePath = {
         // BEFORE resolving, so the error message can name the offending segment.
         for (const seg of segments) {
             if (path.isAbsolute(seg)) {
-                throw new Error(`safePath.joinUnderRoot: segment "${seg}" is absolute and escapes root "${root}".`);
+                throw new PathEscapesRootError(root, `segment "${seg}" is absolute and`);
             }
             // Windows drive-letter check for POSIX hosts (path.isAbsolute won't catch
             // 'C:\...' on POSIX, but node's path.win32.isAbsolute does).
             if (path.win32.isAbsolute(seg)) {
-                throw new Error(`safePath.joinUnderRoot: segment "${seg}" contains a Windows drive letter and escapes root "${root}".`);
+                throw new PathEscapesRootError(root, `segment "${seg}" contains a Windows drive letter and`);
             }
         }
         const resolvedRoot = path.resolve(root);
@@ -275,7 +391,7 @@ export const safePath = {
         // which would match '/rootEvil' when root is '/root').
         const rootPrefix = fwdRoot.endsWith('/') ? fwdRoot : `${fwdRoot}/`;
         if (fwdResult !== fwdRoot && !fwdResult.startsWith(rootPrefix)) {
-            throw new Error(`safePath.joinUnderRoot: result "${fwdResult}" escapes root "${fwdRoot}".`);
+            throw new PathEscapesRootError(fwdRoot, `result "${fwdResult}"`);
         }
         return fwdResult;
     },

package/dist/path-core.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-core.js","sourceRoot":"","sources":["../src/path-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,CAAS;IACjD,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,cAAsB,EAAE,WAAmB;IACvE,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS,EAAE,OAAe;IACvD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,EAAU;IACtD,qDAAqD;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,+DAA+D;IAC/D,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,6DAA6D;IAC7D,IAAI,CAAC,GAAG,KAAe;QACrB,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,gEAAgE;IAChE,OAAO,CAAC,GAAG,KAAe;QACxB,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,iEAAiE;IACjE,QAAQ,CAAC,IAAY,EAAE,EAAU;QAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,aAAa,CAAC,IAAY,EAAE,GAAG,QAAkB;QAC/C,8EAA8E;QAC9E,yEAAyE;QACzE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,mCAAmC,IAAI,IAAI,CACnF,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,uDAAuD,IAAI,IAAI,CACvG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC;YACzC,CAAC,CAAC,YAAY,CAAC;QAEjB,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QACjD,6EAA6E;QAC7E,uDAAuD;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;QAEnE,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,mBAAmB,OAAO,IAAI,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACO,CAAC"}
+{"version":3,"file":"path-core.js","sourceRoot":"","sources":["../src/path-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,2FAA2F;IAC3F,MAAM,CAAU,IAAI,GAAG,mBAAmB,CAAC;IAE3C;;;OAGG;IACH,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,2BAA2B,MAAM,kBAAkB,IAAI,IAAI,CAAC,CAAC;IAChG,CAAC;;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,CAAS;IACjD,uPAAuP;IACvP,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,mBAAmB,CAAC,kBAA0B;IAC5D,uMAAuM;IACvM,OAAO,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;AAC1H,CAAC;AAED,8FAA8F;AAC9F,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,CACL,IAAI,KAAK,EAAE;QACX,IAAI,KAAK,GAAG;QACZ,IAAI,KAAK,IAAI;QACb,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,cAAsB,EAAE,WAAmB;IACvE,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS,EAAE,OAAe;IACvD,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,EAAU;IACtD,qDAAqD;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnC,+DAA+D;IAC/D,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,+GAA+G;AAC/G,MAAM,6BAA6B,GAAG,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC;AAExD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,6BAA6B,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,qIAAqI;IACrI,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,6DAA6D;IAC7D,IAAI,CAAC,GAAG,KAAe;QACrB,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,gEAAgE;IAChE,OAAO,CAAC,GAAG,KAAe;QACxB,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,iEAAiE;IACjE,QAAQ,CAAC,IAAY,EAAE,EAAU;QAC/B,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,aAAa,CAAC,IAAY,EAAE,GAAG,QAAkB;QAC/C,8EAA8E;QAC9E,yEAAyE;QACzE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,mBAAmB,CAAC,CAAC;YAC3E,CAAC;YACD,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,uCAAuC,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,QAAQ,CAAC;YACzC,CAAC,CAAC,YAAY,CAAC;QAEjB,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;QACjD,6EAA6E;QAC7E,uDAAuD;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;QAEnE,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,oBAAoB,CAAC,OAAO,EAAE,WAAW,SAAS,GAAG,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACO,CAAC"}

package/dist/path-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAOlD;;;;;;;;;;GAUG;AACH,cAAc,gBAAgB,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CA+BxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAezC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,GACxC,MAAM,CAiBR;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAGhF"}
+{"version":3,"file":"path-utils.d.ts","sourceRoot":"","sources":["../src/path-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAgB,MAAM,SAAS,CAAC;AAQlD;;;;;;;;;;GAUG;AACH,cAAc,gBAAgB,CAAC;AAmC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAqBxD;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,GACxC,MAAM,CAIR;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAQ1F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAGhF"}