yugoo-design 0.1.2 → 0.2.0

package/payload/shared/scripts/studio-panel-drafts-Dq171F6x.mjs

@@ -0,0 +1,393 @@
+import { n as readStudioArchiveResource } from "./content-archive-CnwVcuWA.mjs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+import { lstat, mkdir, open, readFile, readdir, realpath, rename, rmdir, unlink } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+//#region packages/studio/src/instance-changes.ts
+const STUDIO_INSTANCE_CHANGE_LIMITS = Object.freeze({
+	files: 64,
+	fileBytes: 1048576,
+	totalBytes: 4194304,
+	diffBytes: 8388608,
+	sampleBytes: 262144
+});
+/** Copy before any asynchronous host work so callers cannot mutate an in-flight edit. */
+function normalizeStudioInstanceChanges(value) {
+	const { files, fileBytes, totalBytes, sampleBytes } = STUDIO_INSTANCE_CHANGE_LIMITS;
+	if (!value || typeof value.id !== "string" || !value.id || value.id.length > 128 || !Number.isSafeInteger(value.expectedRevision) || value.expectedRevision < 0 || value.expectedRevision >= Number.MAX_SAFE_INTEGER || !Array.isArray(value.changes) || !value.changes.length || value.changes.length > files) throw new Error(`Select an instance revision and 1–${files} file changes.`);
+	const seen = /* @__PURE__ */ new Set(), encoder = new TextEncoder();
+	let bytes = 0;
+	const changes = value.changes.map((change) => {
+		const { path, content } = change ?? {};
+		if (typeof path !== "string" || !path || path.length > 1024 || /[\\:\u0000-\u001f\u007f]/u.test(path) || path.split("/").length > 32 || path.split("/").some((part) => !part || [
+			".",
+			"..",
+			".git",
+			"node_modules",
+			"__proto__",
+			"constructor",
+			"prototype"
+		].includes(part)) || seen.has(path)) throw new Error("Invalid or duplicate instance source path.");
+		seen.add(path);
+		if (content !== null && (typeof content !== "string" || content.length > fileBytes || !content.isWellFormed() || content.includes("\0") || encoder.encode(content).length > fileBytes)) throw new Error("Source must be UTF-8 text of at most 1 MiB per file.");
+		bytes += encoder.encode(path).length + (content === null ? 0 : encoder.encode(content).length);
+		if (bytes > totalBytes) throw new Error("Instance changes exceed the 4 MiB total text budget.");
+		return Object.freeze({
+			path,
+			content
+		});
+	});
+	if (value.sampleSource !== void 0 && (typeof value.sampleSource !== "string" || value.sampleSource.length > sampleBytes || !value.sampleSource.isWellFormed() || encoder.encode(value.sampleSource).length > sampleBytes)) throw new Error("Isolated preview sample must be UTF-8 JSON text of at most 256 KiB.");
+	const bundle = value.bundle;
+	if (bundle !== void 0 && (typeof bundle.name !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(bundle.name) || typeof bundle.version !== "string" || !/^\d+\.\d+$/.test(bundle.version))) throw new Error("Select an exact preview Bundle pin.");
+	return Object.freeze({
+		id: value.id,
+		expectedRevision: value.expectedRevision,
+		changes: Object.freeze(changes),
+		...bundle ? { bundle: Object.freeze({
+			name: bundle.name,
+			version: bundle.version
+		}) } : {},
+		...value.sampleSource === void 0 ? {} : { sampleSource: value.sampleSource }
+	});
+}
+//#endregion
+//#region packages/studio/src/node/studio-panel-drafts.mjs
+/** Atomic local source storage and retained trial captures. No project writes. */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const HASH = /^[0-9a-f]{64}$/;
+const MAX_SOURCE_BYTES = 16777216;
+const MAX_DOCUMENT_BYTES = 2097152;
+const inside = (root, path) => {
+	const rel = relative(root, path);
+	return !isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${sep}`);
+};
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const moveToSystemTrash = async (file) => {
+	const { default: trash } = await import("trash");
+	await trash([file], { glob: false });
+};
+/** Existing namespaces preserve saved source and historical trial data. */
+async function createStudioDraftPorts({ stateRoot, kitRoot, readInstalledKit, readInstalledBundle, moveToTrash = moveToSystemTrash }, kind) {
+	if (!["panel", "instance"].includes(kind)) throw new Error("Select the Panel history or instance source namespace.");
+	if (!isAbsolute(stateRoot)) throw new Error("Studio requires an explicit absolute state directory.");
+	if (kind === "instance" && typeof moveToTrash !== "function") throw new Error("Studio requires a system trash adapter.");
+	const kitRootReal = kind === "instance" && kitRoot === void 0 ? void 0 : await realpath(kitRoot);
+	if (kitRootReal && inside(kitRootReal, resolve(stateRoot))) throw new Error("Studio drafts must not live inside the installed Kit.");
+	await mkdir(stateRoot, {
+		recursive: true,
+		mode: 448
+	});
+	const state = await realpath(stateRoot);
+	const root = join(state, `studio-${kind}-drafts`);
+	const format = `studio-${kind}-draft/v1`;
+	if (kitRootReal && inside(kitRootReal, root)) throw new Error("Studio drafts must not live inside the installed Kit.");
+	await mkdir(root, {
+		recursive: true,
+		mode: 448
+	});
+	if ((await lstat(root)).isSymbolicLink()) throw new Error("Studio storage cannot be a symlink.");
+	const snapshots = join(root, "snapshots");
+	await mkdir(snapshots, { mode: 448 }).catch((error) => {
+		if (error.code !== "EEXIST") throw error;
+	});
+	if (!(await lstat(snapshots)).isDirectory() || (await lstat(snapshots)).isSymbolicLink()) throw new Error("Unsafe Studio snapshot directory.");
+	const withLock = async (operation) => {
+		const lock = join(root, "write.lock");
+		try {
+			await mkdir(lock, { mode: 448 });
+		} catch (error) {
+			if (error.code === "EEXIST") throw new Error("Studio is being saved elsewhere. Retry; after a crash, stop Studio before clearing its empty write.lock directory.");
+			throw error;
+		}
+		try {
+			return await operation();
+		} finally {
+			await rmdir(lock);
+		}
+	};
+	const readRegular = async (file, limit) => {
+		const info = await lstat(file);
+		if (!info.isFile() || info.isSymbolicLink() || info.size > limit) throw new Error("Invalid or oversized Studio file.");
+		return readFile(file, "utf8");
+	};
+	const writeAtomic = async (file, text) => {
+		const temporary = join(root, `${randomUUID()}.tmp`);
+		let handle;
+		try {
+			handle = await open(temporary, "wx", 384);
+			await handle.writeFile(text, "utf8");
+			await handle.sync();
+			await handle.close();
+			handle = void 0;
+			await rename(temporary, file);
+		} finally {
+			await handle?.close();
+			await unlink(temporary).catch((error) => {
+				if (error.code !== "ENOENT") throw error;
+			});
+		}
+	};
+	const draftPath = (id) => {
+		if (typeof id !== "string" || !UUID.test(id)) throw new Error("Invalid Studio source identity.");
+		return join(root, `${id}.json`);
+	};
+	const read = async (id) => {
+		const record = JSON.parse(await readRegular(draftPath(id), MAX_DOCUMENT_BYTES));
+		const pin = (value) => typeof value?.name === "string" && typeof value?.version === "string";
+		const validContent = kind === "panel" ? typeof record.panelSource === "string" && typeof record.sampleSource === "string" && pin(record.kit) && pin(record.bundle) : ["kit", "bundle"].includes(record.kind) && (record.recordVersion === 2 ? pin(record[record.kind]) && typeof record.sourceId === "string" && (record.current === true || record.sourceId === `local:${record.kind}:${record[record.kind].name}`) && (record.kind !== "bundle" || typeof record.runtimeName === "string") : (record.recordVersion === void 0 || record.recordVersion === 1) && pin(record.source?.kit) && (record.kind !== "bundle" || pin(record.source?.bundle) && typeof record.bundlePath === "string")) && typeof record.title?.zh === "string" && typeof record.title?.en === "string" && record.overlays !== null && typeof record.overlays === "object" && !Array.isArray(record.overlays) && Object.values(record.overlays).every((value) => typeof value === "string") && Array.isArray(record.mounts) && record.mounts.every((mount) => pin(mount.bundle)) && (record.recordVersion !== 2 || record.mounts.every((mount) => typeof mount.bindingKey === "string" && HASH.test(mount.bundle.source?.snapshot) && typeof mount.bundle.source?.sourceId === "string" && (mount.bundle.instanceId === void 0 || UUID.test(mount.bundle.instanceId)) && (mount.bundle.revision === void 0 || Number.isSafeInteger(mount.bundle.revision) && mount.bundle.revision >= 0)));
+		if (record.format !== format || record.id !== id || !Number.isSafeInteger(record.revision) || record.revision < 0 || !HASH.test(record.baseSnapshot) || !validContent) throw new Error("Invalid Studio source record.");
+		const { format: _format, ...value } = record;
+		if (kind === "instance") delete value.confirmed;
+		return value;
+	};
+	const persist = async (record) => {
+		if (kind === "instance") {
+			const { confirmed: _confirmed, ...source } = record;
+			record = source;
+		}
+		const text = JSON.stringify({
+			format,
+			...record
+		});
+		if (Buffer.byteLength(text) > MAX_DOCUMENT_BYTES) throw new Error("Studio source record exceeds 2 MiB.");
+		await writeAtomic(draftPath(record.id), text);
+		return record;
+	};
+	const repository = {
+		read,
+		async list() {
+			const ids = (await readdir(root)).filter((name) => name.endsWith(".json") && UUID.test(name.slice(0, -5))).sort();
+			return Promise.all(ids.map((name) => read(name.slice(0, -5))));
+		},
+		create: (content) => withLock(() => createUnlocked(content)),
+		replace: (id, expectedRevision, content) => withLock(() => replaceUnlocked(id, expectedRevision, content))
+	};
+	const createUnlocked = async (content) => {
+		return persist({
+			...content,
+			id: randomUUID(),
+			revision: 0
+		});
+	};
+	const replaceUnlocked = async (id, expectedRevision, content) => {
+		if ((await read(id)).revision !== expectedRevision) throw new Error("Studio source changed elsewhere. Reopen it before saving.");
+		return persist({
+			...content,
+			id,
+			revision: expectedRevision + 1
+		});
+	};
+	if (kind === "instance") repository.transaction = (operation) => withLock(() => operation({
+		read,
+		list: repository.list,
+		create: createUnlocked,
+		replace: replaceUnlocked,
+		retainTree: (entries) => retainEntriesUnlocked(checkEntries(entries)),
+		async trash(id, expectedRevision) {
+			const current = await read(id);
+			if (current.revision !== expectedRevision) throw new Error("Studio source changed elsewhere. Reopen it before deleting.");
+			const file = draftPath(id);
+			await moveToTrash(file);
+			try {
+				await lstat(file);
+				throw new Error("The system trash did not move this Studio working copy.");
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+			}
+			return {
+				id,
+				revision: current.revision,
+				trashed: true
+			};
+		},
+		async migrate(id, expectedRevision, content) {
+			const current = await read(id);
+			if (current.revision !== expectedRevision || current.recordVersion === 2) throw new Error("Legacy instance changed or was already migrated.");
+			const backup = join(root, `${id}.legacy-v1.json`);
+			const original = JSON.stringify({
+				format,
+				...current
+			});
+			try {
+				if (await readRegular(backup, MAX_DOCUMENT_BYTES) !== original) throw new Error("Existing legacy recovery backup differs from the current record.");
+			} catch (error) {
+				if (error.code !== "ENOENT") throw error;
+				await writeAtomic(backup, original);
+			}
+			return replaceUnlocked(id, expectedRevision, content);
+		}
+	}));
+	const openSnapshot = async (id) => {
+		if (typeof id !== "string" || !HASH.test(id)) throw new Error("Invalid Studio source snapshot.");
+		const text = await readRegular(join(snapshots, `${id}.json`), MAX_SOURCE_BYTES * 2);
+		if (hash(text) !== id) throw new Error("Studio source snapshot integrity check failed.");
+		const document = JSON.parse(text);
+		const closure = Array.isArray(document) ? void 0 : document;
+		if (closure && closure.format !== "studio-source-closure/v1") throw new Error("Invalid Studio source closure.");
+		const entries = closure ? closure.entries : document;
+		const files = new Map(entries);
+		const virtualRoot = resolve(root, "virtual-source", id);
+		const keyOf = (path) => {
+			const absolute = resolve(path);
+			if (!inside(virtualRoot, absolute)) throw new Error("Preview path escapes its source snapshot.");
+			return relative(virtualRoot, absolute).split(sep).join("/");
+		};
+		const children = (path) => {
+			const key = keyOf(path), prefix = key ? `${key}/` : "";
+			return [...new Set([...files.keys()].filter((file) => file.startsWith(prefix)).map((file) => file.slice(prefix.length).split("/")[0]))].sort();
+		};
+		const snapshotRoot = closure ? resolve(virtualRoot, closure.kitPath) : virtualRoot;
+		keyOf(snapshotRoot);
+		const loadOptions = closure ? {
+			sourceId: closure.sourceId,
+			bundles: closure.bundles.map((bundle) => {
+				const rootDir = resolve(virtualRoot, bundle.path);
+				keyOf(rootDir);
+				return {
+					name: bundle.name,
+					version: bundle.version,
+					sourceId: bundle.sourceId,
+					rootDir
+				};
+			})
+		} : void 0;
+		return {
+			id,
+			root: snapshotRoot,
+			storageRoot: virtualRoot,
+			...loadOptions ? { loadOptions } : {},
+			fs: {
+				async readBytes(path) {
+					const bytes = files.get(keyOf(path));
+					return bytes === void 0 ? void 0 : Buffer.from(bytes, "base64");
+				},
+				async readText(path) {
+					const bytes = files.get(keyOf(path));
+					return bytes === void 0 ? void 0 : new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(bytes, "base64"));
+				},
+				async readResource(path) {
+					const bytes = files.get(keyOf(path));
+					return bytes === void 0 ? void 0 : readStudioArchiveResource(path, Buffer.from(bytes, "base64"));
+				},
+				async listDir(path) {
+					return children(path);
+				},
+				async isDirectory(path) {
+					return children(path).length > 0;
+				},
+				async realPath(path) {
+					keyOf(path);
+					return resolve(path);
+				}
+			}
+		};
+	};
+	const checkEntries = (entries) => {
+		if (!Array.isArray(entries) || entries.length > 4096) throw new Error("Source tree exceeds 4096 files.");
+		const seen = /* @__PURE__ */ new Set();
+		let bytes = 0;
+		return entries.map((entry) => {
+			const { path, base64 } = entry ?? {};
+			if (typeof path !== "string" || !path || path.length > 1024 || /[\\:\u0000-\u001f\u007f]/u.test(path) || path.split("/").some((part) => !part || [
+				".",
+				"..",
+				".git",
+				"node_modules"
+			].includes(part)) || seen.has(path) || typeof base64 !== "string" || Buffer.from(base64, "base64").toString("base64") !== base64) throw new Error("Invalid source tree entry.");
+			seen.add(path);
+			bytes += Buffer.byteLength(base64, "base64");
+			if (bytes > MAX_SOURCE_BYTES) throw new Error("Source tree exceeds 16 MiB.");
+			return [path, base64];
+		}).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0);
+	};
+	const retainEntriesUnlocked = async (entries, closure) => {
+		const text = JSON.stringify(closure ? {
+			...closure,
+			entries
+		} : entries), id = hash(text), destination = join(snapshots, `${id}.json`);
+		try {
+			if (hash(await readRegular(destination, MAX_SOURCE_BYTES * 2)) !== id) throw new Error("Studio snapshot content mismatch.");
+			return openSnapshot(id);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+		await writeAtomic(destination, text);
+		return openSnapshot(id);
+	};
+	const retainEntries = (entries, closure) => withLock(() => retainEntriesUnlocked(entries, closure));
+	const sources = {
+		open: openSnapshot,
+		...kind === "instance" ? { retainTree: (entries) => withLock(() => retainEntriesUnlocked(checkEntries(entries))) } : {},
+		async capture(pin) {
+			if (!kitRootReal || typeof readInstalledKit !== "function") throw new Error("Installed Kit capture is not configured for this storage port.");
+			const installed = await readInstalledKit();
+			if (pin.name !== installed.name) throw new Error("Select the current installed Kit identity.");
+			const entries = [], ignored = /* @__PURE__ */ new Set([".git", "node_modules"]);
+			let total = 0, nodes = 0;
+			const walk = async (directory, base, prefix) => {
+				if (++nodes > 8192 || relative(base, directory).split(sep).length > 32) throw new Error("Studio source tree exceeds directory limits.");
+				for (const name of (await readdir(directory)).sort()) {
+					if (ignored.has(name)) continue;
+					const file = join(directory, name), info = await lstat(file);
+					if (info.isSymbolicLink()) throw new Error("Studio cannot snapshot source symlinks.");
+					if (info.isDirectory()) await walk(file, base, prefix);
+					else if (info.isFile()) {
+						if (total + info.size > MAX_SOURCE_BYTES || entries.length >= 4096) throw new Error("Kit preview snapshot exceeds 16 MiB or 4096 files.");
+						const bytes = await readFile(file);
+						total += bytes.length;
+						if (total > MAX_SOURCE_BYTES) throw new Error("Kit preview snapshot exceeds 16 MiB.");
+						entries.push([prefix + relative(base, file).split(sep).join("/"), bytes.toString("base64")]);
+					} else throw new Error("Studio sources must be regular files or directories.");
+				}
+			};
+			const sourceRoot = resolve(installed.sourceRoot ?? kitRootReal);
+			if (await realpath(sourceRoot) !== sourceRoot) throw new Error("Studio cannot snapshot source symlinks.");
+			if (await readFile(join(sourceRoot, "kit.yaml"), "utf8").catch((error) => {
+				if (error.code === "ENOENT") return void 0;
+				throw error;
+			}) === void 0) {
+				await walk(sourceRoot, sourceRoot, "");
+				return retainEntries(entries);
+			}
+			if (!Array.isArray(installed.skills)) throw new Error("Independent capture requires compiled mounted Bundles.");
+			const kitPath = `kits/${installed.name}`, bundles = [];
+			await walk(sourceRoot, sourceRoot, `${kitPath}/`);
+			for (const skill of installed.skills) {
+				const pin = {
+					name: skill.catalogName ?? skill.name,
+					version: String(skill.version)
+				};
+				const retained = await readInstalledBundle?.(pin);
+				const bundleRoot = resolve(retained?.resourceRoot ?? skill.resourceRoot ?? "");
+				if (!retained?.resourceRoot && !skill.resourceRoot) throw new Error("Mounted Bundle source root is missing.");
+				if (await realpath(bundleRoot) !== bundleRoot) throw new Error("Studio cannot snapshot source symlinks.");
+				const path = `bundles/${pin.name}`;
+				await walk(bundleRoot, bundleRoot, `${path}/`);
+				bundles.push({
+					...pin,
+					path,
+					sourceId: retained?.sourceId ?? "companion:explicit-kit"
+				});
+			}
+			const checked = checkEntries(entries.map(([path, base64]) => ({
+				path,
+				base64
+			})));
+			return retainEntries(checked, {
+				format: "studio-source-closure/v1",
+				kitPath,
+				sourceId: "companion:explicit-kit",
+				bundles
+			});
+		}
+	};
+	return {
+		repository: kind === "panel" ? {
+			read,
+			list: repository.list
+		} : repository,
+		sources
+	};
+}
+//#endregion
+export { STUDIO_INSTANCE_CHANGE_LIMITS as n, normalizeStudioInstanceChanges as r, createStudioDraftPorts as t };

package/payload/shared/scripts/{windows-private-storage-DRAXaqae.mjs → windows-native-platform-DLm-tedp.mjs}

@@ -1,13 +1,13 @@
 import { promisify } from "node:util";
-import { dirname, resolve, win32 } from "node:path";
-import { lstat, mkdir } from "node:fs/promises";
+import { win32 } from "node:path";
+import "node:fs/promises";
 import { execFile, spawn } from "node:child_process";
 import "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createInterface } from "node:readline";
-//#region packages/companion/src/windows-native-platform.mjs
+//#region packages/studio/src/node/windows-native-platform.mjs
 /** Windows facts from native OS tools; no application IPC or model access. */
-const execute$1 = promisify(execFile);
+const execute = promisify(execFile);
 const inspectionScope = new AsyncLocalStorage();
 async function withWindowsInspection(callback, { createInspector = createWindowsProcessInspector } = {}) {
 	if (inspectionScope.getStore()) return callback();
@@ -36,7 +36,7 @@ function windowsSystemTool(name) {
 }
 async function windowsPowerShell(script) {
 	if (process.platform !== "win32") throw Error("Windows native inspection requires Windows.");
-	const { stdout } = await execute$1(windowsSystemTool("WindowsPowerShell/v1.0/powershell.exe"), [
+	const { stdout } = await execute(windowsSystemTool("WindowsPowerShell/v1.0/powershell.exe"), [
 		"-NoProfile",
 		"-NonInteractive",
 		"-EncodedCommand",
@@ -54,7 +54,7 @@ let currentSid;
 async function windowsCurrentSid() {
 	if (process.platform !== "win32") throw Error("Windows SID requires Windows.");
 	if (currentSid) return currentSid;
-	const { stdout } = await execute$1(windowsSystemTool("whoami.exe"), [
+	const { stdout } = await execute(windowsSystemTool("whoami.exe"), [
 		"/user",
 		"/fo",
 		"csv",
@@ -255,147 +255,4 @@ function windowsCommandArgs(command) {
 	return args;
 }
 //#endregion
-//#region packages/companion/src/windows-private-storage.mjs
-/** Validate actual Windows ACLs instead of treating Unix mode bits as proof. */
-const execute = promisify(execFile);
-function daclOf(sddl) {
-	const dacl = /D:([^]*?)(?=S:|$)/.exec(sddl)?.[1];
-	if (!dacl) throw Error("Windows storage has no explicit DACL.");
-	return [...dacl.matchAll(/\(([^()]*)\)/g)].map((match) => match[1].split(";"));
-}
-/** Ancestors may grant read/execute, but must not let another user replace paths. */
-function validateAncestorSddl(sddl, sid) {
-	const trusted = [
-		sid,
-		"SY",
-		"BA",
-		"S-1-5-18",
-		"S-1-5-32-544",
-		"S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464"
-	];
-	const owner = /^O:([^:]+?)(?=G:|D:|S:|$)/.exec(sddl)?.[1];
-	if (!trusted.includes(owner)) throw Error("Windows storage ancestor has an untrusted owner.");
-	for (const ace of daclOf(sddl)) {
-		if (ace.length !== 6 || !["A", "D"].includes(ace[0])) throw Error("Unsupported Windows ancestor ACE.");
-		if (ace[0] === "D" || ace[1].includes("IO") || trusted.includes(ace[5])) continue;
-		const rights = ace[2];
-		const symbols = {
-			FA: 2032127n,
-			FR: 1179785n,
-			FX: 1179808n,
-			FW: 1179926n,
-			GA: 2032127n,
-			GR: 1179785n,
-			GX: 1179808n,
-			GW: 1179926n,
-			LC: 4n,
-			RC: 131072n,
-			SD: 65536n,
-			WD: 262144n,
-			WO: 524288n
-		};
-		let mask = 0n;
-		if (/^0x[0-9a-f]+$/i.test(rights)) mask = BigInt(rights);
-		else {
-			if (!rights || rights.length % 2) throw Error("Unsupported Windows ancestor rights.");
-			for (let index = 0; index < rights.length; index += 2) {
-				const value = symbols[rights.slice(index, index + 2)];
-				if (value === void 0) throw Error("Unsupported Windows ancestor rights.");
-				mask |= value;
-			}
-		}
-		if (mask & 852032n) throw Error("Windows storage ancestor is replaceable by another principal.");
-		if (mask & 272n) throw Error("Windows storage ancestor allows untrusted attribute writes.");
-		if (mask & -1179824n) throw Error("Unsupported Windows ancestor rights.");
-	}
-}
-function validatePrivateSddl(sddl, sid, { protectedAcl = false } = {}) {
-	if (typeof sddl !== "string" || !/^S-1-5-\d+(?:-\d+)+$/.test(sid)) throw Error("Invalid Windows security identity.");
-	const owner = /^O:([^:]+?)(?=G:|D:|S:|$)/.exec(sddl)?.[1];
-	const dacl = /D:([^]*?)(?=S:|$)/.exec(sddl)?.[1];
-	if (owner !== sid || !dacl || protectedAcl && !/^P/.test(dacl)) throw Error("Windows private storage owner or inheritance mismatch.");
-	const aces = [...dacl.matchAll(/\(([^()]*)\)/g)].map((match) => match[1].split(";"));
-	if (!aces.length || !aces.some((ace) => ace[0] === "A" && !ace[1].includes("IO") && ace[5] === sid && ace[2] === "FA")) throw Error("Windows private storage lacks user access.");
-	for (const ace of aces) {
-		if (ace.length !== 6 || ace[0] !== "A") throw Error("Unsupported Windows storage ACE.");
-		if (ace[0] === "A" && ![
-			sid,
-			"SY",
-			"BA",
-			"S-1-5-18",
-			"S-1-5-32-544"
-		].includes(ace[5])) throw Error("Windows storage allows another principal.");
-	}
-}
-async function assertWindowsPrivate(path, { directory = false, protectedAcl = directory } = {}) {
-	const stat = await lstat(path);
-	if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile())) throw Error("Private storage must be a regular owned path.");
-	const paths = [];
-	let current = resolve(path);
-	while (true) {
-		paths.push(current);
-		const parent = dirname(current);
-		if (parent === current) break;
-		current = parent;
-	}
-	const facts = await windowsSecurityFacts(paths);
-	if (facts.length !== paths.length * 2 || paths.some((_, i) => !/^\d+$/.test(facts[i * 2]) || Number(facts[i * 2]) & 1024)) throw Error("Private storage uses a Windows reparse point or missing ancestor.");
-	const sid = await windowsCurrentSid();
-	validatePrivateSddl(facts[1], sid, { protectedAcl });
-	for (let index = 1; index < paths.length; index++) validateAncestorSddl(facts[index * 2 + 1], sid);
-	return stat;
-}
-async function assertSafeAncestors(path, sid) {
-	const ancestors = [];
-	let current = path;
-	while (true) {
-		ancestors.push(current);
-		const parent = dirname(current);
-		if (parent === current) break;
-		current = parent;
-	}
-	const facts = (await windowsPowerShell(`foreach ($entry in @(${ancestors.map(powerShellLiteral).join(",")})) { if (Test-Path -LiteralPath $entry) { (Get-Acl -LiteralPath $entry).Sddl } else { 'missing' } }`)).split(/\r?\n/);
-	if (facts.length !== ancestors.length) throw Error("Incomplete Windows ancestor security facts.");
-	for (const sddl of facts) if (sddl !== "missing") validateAncestorSddl(sddl, sid);
-}
-async function assertNoReparse(path, allowMissing = false, includeSddl = false) {
-	let current = resolve(path);
-	const ancestors = [];
-	while (true) {
-		ancestors.push(current);
-		const parent = dirname(current);
-		if (parent === current) break;
-		current = parent;
-	}
-	const suffix = includeSddl ? `; (Get-Acl -LiteralPath ${powerShellLiteral(path)}).Sddl` : "";
-	const facts = (await windowsPowerShell(`foreach ($entry in @(${ancestors.map(powerShellLiteral).join(",")})) { if (Test-Path -LiteralPath $entry) { (Get-Item -Force -LiteralPath $entry).Attributes.value__ } else { 'missing' } }${suffix}`)).split(/\r?\n/);
-	const sddl = includeSddl ? facts.pop() : void 0;
-	if (facts.length !== ancestors.length || facts.some((attributes) => !(allowMissing && attributes === "missing") && (!/^\d+$/.test(attributes) || Number(attributes) & 1024))) throw Error("Private storage uses a Windows reparse point or missing ancestor.");
-	return sddl;
-}
-async function ensureWindowsPrivateDirectory(path) {
-	await assertNoReparse(path, true);
-	await assertSafeAncestors(dirname(resolve(path)), await windowsCurrentSid());
-	await mkdir(dirname(path), { recursive: true });
-	try {
-		await mkdir(path);
-	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
-		await assertWindowsPrivate(path, { directory: true });
-		return;
-	}
-	const sid = await windowsCurrentSid();
-	await execute(windowsSystemTool("icacls.exe"), [
-		path,
-		"/inheritance:r",
-		"/grant:r",
-		`*${sid}:(OI)(CI)F`
-	], {
-		encoding: "utf8",
-		timeout: 1e4,
-		windowsHide: true
-	});
-	await assertWindowsPrivate(path, { directory: true });
-}
-//#endregion
-export { createWindowsProcessInspector as a, withWindowsInspection as c, validatePrivateSddl as i, ensureWindowsPrivateDirectory as n, windowsCommandArgs as o, validateAncestorSddl as r, windowsProcess as s, assertWindowsPrivate as t };
+export { windowsPowerShell as a, windowsSystemTool as c, windowsCurrentSid as i, withWindowsInspection as l, powerShellLiteral as n, windowsProcess as o, windowsCommandArgs as r, windowsSecurityFacts as s, createWindowsProcessInspector as t };