@agen-ai/sandbox 0.0.0-stage → 0.4.4

package/dist/lifecycle/transfer.js

@@ -0,0 +1,339 @@
+import { SandboxOperationError } from "../errors.js";
+import { TransferBody } from "../files/bytes.js";
+import { TransferIterator } from "../files/iterator.js";
+import { createMetadataLedger, MetadataCleanupError } from "../files/metadata/index.js";
+import { parseTreeMetadata, transferData } from "../files/parse.js";
+import { parseSandboxRelativePath } from "../files/paths.js";
+import { TransferCounters } from "../files/quotas.js";
+class TransferDispatch {
+  constructor(pull, interrupt) {
+    this.pull = pull;
+    this.interrupt = interrupt;
+  }
+  claimed = false;
+  retired = false;
+  ended = false;
+  pending;
+  failure;
+  [Symbol.asyncIterator]() {
+    if (this.claimed || this.retired) throw this.fail("Tree sources are once-only and scoped to the transfer.");
+    this.claimed = true;
+    return { next: () => this.next(), return: async () => {
+      this.retired = true;
+      return { done: true, value: void 0 };
+    } };
+  }
+  fail(message) {
+    const error = new SandboxOperationError("driver_failure", message);
+    this.failure ??= { error };
+    this.interrupt(error);
+    return error;
+  }
+  next() {
+    if (this.pending || this.retired) return Promise.reject(this.fail("Concurrent or retired tree pulls are forbidden."));
+    if (this.ended) return Promise.resolve({ done: true, value: void 0 });
+    const actual = Promise.resolve().then(this.pull);
+    this.pending = actual;
+    void actual.then(
+      (result) => {
+        this.pending = void 0;
+        this.ended = result.done === true;
+      },
+      (error) => {
+        this.pending = void 0;
+        this.failure ??= { error };
+      }
+    );
+    return actual;
+  }
+  async finish() {
+    if (this.pending) this.fail("Backend returned with a tree pull still pending.");
+    await this.close();
+    if (this.failure) throw this.failure.error;
+    if (!this.ended) throw this.fail("Backend did not completely consume its tree source.");
+  }
+  async close() {
+    this.retired = true;
+    await this.pending?.catch(() => {
+    });
+  }
+}
+class TransferResources {
+  ledgers = [];
+  acquisitionCleanup;
+  source;
+  body;
+  entered;
+  dispatch;
+  clean = false;
+  closing;
+  closeFailed = false;
+  get cleanupFailed() {
+    return this.closeFailed;
+  }
+  close(retry = false) {
+    if (this.closing && (!retry || !this.closeFailed)) return this.closing;
+    this.closeFailed = false;
+    const actual = this.closeResources(retry);
+    this.closing = actual;
+    void actual.catch(() => {
+      this.closeFailed = true;
+    });
+    return actual;
+  }
+  async closeResources(retry) {
+    await this.entered?.catch(() => {
+    });
+    await this.dispatch?.close();
+    const results = await Promise.allSettled([
+      this.body?.close(retry),
+      this.source?.close(retry),
+      this.acquisitionCleanup?.close(retry),
+      ...this.ledgers.map((ledger2) => ledger2.close())
+    ]);
+    const failures = results.filter((result) => result.status === "rejected");
+    if (failures.length !== 0) throw new AggregateError(failures.map((result) => result.reason), "Transfer cleanup retains unfinished resources.");
+    this.clean = true;
+  }
+  async finishBody() {
+    const body = this.body;
+    if (!body) return;
+    body.assertComplete();
+    await body.close();
+    this.body = void 0;
+  }
+}
+function ownTransfer(controller, perform) {
+  const resources = new TransferResources();
+  const actual = Promise.resolve().then(async () => {
+    let primary;
+    let summary;
+    try {
+      controller.signal.throwIfAborted();
+      summary = await perform(resources);
+    } catch (error) {
+      primary = { error };
+      controller.abort(error);
+    }
+    try {
+      await resources.close();
+    } catch (error) {
+      if (primary && error instanceof AggregateError && error.errors.every((cause) => Object.is(cause, primary.error))) throw primary.error;
+      if (primary) throw new AggregateError([primary.error, error], "Transfer and its cleanup both failed.");
+      throw error;
+    }
+    if (primary) throw primary.error;
+    if (!summary) throw new SandboxOperationError("driver_failure", "Transfer returned no summary.");
+    return summary;
+  });
+  return { actual, get clean() {
+    return resources.clean;
+  }, async cleanup() {
+    const retry = resources.cleanupFailed;
+    await actual.catch(() => {
+    });
+    if (!resources.clean) await resources.close(retry);
+  } };
+}
+async function ledger(ready, options, resources) {
+  try {
+    const result = await createMetadataLedger({
+      openSpill: () => ready.openSpill({ signal: options.signal }),
+      batchBytes: options.buffers.metadataBatchBytes,
+      fanIn: options.buffers.metadataMergeFanIn,
+      signal: options.signal
+    });
+    resources.ledgers.push(result);
+    return result;
+  } catch (error) {
+    if (error instanceof MetadataCleanupError) resources.acquisitionCleanup = {
+      close: (retry = false) => retry ? error.retryCleanup() : Promise.reject(error.cleanupError)
+    };
+    throw error;
+  }
+}
+function importTree(ready, entries, selected) {
+  const controller = new AbortController();
+  const options = { ...selected, signal: AbortSignal.any([selected.signal, controller.signal]) };
+  return ownTransfer(controller, async (resources) => {
+    const metadata = await ledger(ready, options, resources);
+    const source = new TransferIterator(entries);
+    resources.source = source;
+    const counts = new TransferCounters(options.quotas, "import");
+    const admitted = new TransferDispatch(async () => {
+      options.signal.throwIfAborted();
+      await resources.finishBody();
+      const next = await source.next();
+      options.signal.throwIfAborted();
+      if (next.done) return { done: true, value: void 0 };
+      const entry = parseTreeMetadata(next.value, "open");
+      counts.admit(entry);
+      await metadata.append(entry);
+      if (entry.kind === "directory") return { done: false, value: entry };
+      const open = entry.body;
+      const body = new TransferBody(
+        entry.byteLength,
+        options.buffers.chunkBytes,
+        true,
+        options.signal,
+        () => Reflect.apply(open, void 0, [{ signal: options.signal }]),
+        (error) => controller.abort(error)
+      );
+      resources.body = body;
+      let opened = false;
+      return { done: false, value: Object.freeze({
+        kind: "file",
+        path: entry.path,
+        byteLength: entry.byteLength,
+        executable: entry.executable,
+        open() {
+          if (opened) return body.rejectReuse();
+          opened = true;
+          return body;
+        }
+      }) };
+    }, (error) => controller.abort(error));
+    resources.dispatch = admitted;
+    const summary = await ready.importTree(admitted, options);
+    await admitted.finish();
+    await resources.finishBody();
+    await metadata.finish();
+    options.signal.throwIfAborted();
+    return counts.verify(summary);
+  });
+}
+async function selection(ready, input, options, resources, interrupt) {
+  const data = transferData(input, ["kind", "paths", "path"]);
+  if (data.kind === "workspace" && Reflect.ownKeys(data).length === 1) return { selected: Object.freeze({ kind: "workspace" }) };
+  if (data.kind === "subtree" && Reflect.ownKeys(data).length === 2) {
+    const path = parseSandboxRelativePath(data.path);
+    new TransferCounters(options.quotas, "export").check("maxPaths", 1n);
+    return { selected: Object.freeze({ kind: "subtree", path }) };
+  }
+  if (data.kind !== "files" || Reflect.ownKeys(data).length !== 2) throw new SandboxOperationError("input_limit", "Export requires a workspace, exact-file list or one directory subtree.");
+  const expected = await ledger(ready, options, resources);
+  const source = new TransferIterator(data.paths);
+  resources.source = source;
+  const counts = new TransferCounters(options.quotas, "export");
+  let paths = 0n;
+  while (true) {
+    options.signal.throwIfAborted();
+    const next = await source.next();
+    if (next.done) break;
+    const path = parseSandboxRelativePath(next.value);
+    paths += 1n;
+    counts.check("maxPaths", paths);
+    await expected.append({ kind: "file", path });
+  }
+  await source.close();
+  resources.source = void 0;
+  await expected.finish();
+  const replay = new TransferDispatch(async () => {
+    options.signal.throwIfAborted();
+    const next = await cursor.next();
+    return next.done ? { done: true, value: void 0 } : { done: false, value: next.value.path };
+  }, interrupt);
+  const cursor = new TransferIterator(expected.records());
+  resources.dispatch = replay;
+  resources.source = cursor;
+  return { selected: Object.freeze({ kind: "files", paths: replay }), expected, complete: () => replay.finish() };
+}
+async function verifySelected(expected, observed) {
+  const left = new TransferIterator(expected.records());
+  const right = new TransferIterator(observed.records());
+  try {
+    while (true) {
+      const [wanted, actual] = await Promise.all([left.next(), right.next()]);
+      if (wanted.done && actual.done) return;
+      if (wanted.done || actual.done || wanted.value.path !== actual.value.path || actual.value.kind !== "file") {
+        throw new SandboxOperationError("driver_failure", "Backend did not export exactly the selected regular files.");
+      }
+    }
+  } finally {
+    await Promise.all([left.close(), right.close()]);
+  }
+}
+function exportTree(ready, input, consume, selectedOptions) {
+  const controller = new AbortController();
+  const options = { ...selectedOptions, signal: AbortSignal.any([selectedOptions.signal, controller.signal]) };
+  return ownTransfer(controller, async (resources) => {
+    if (typeof consume !== "function") throw new SandboxOperationError("input_limit", "Export requires an asynchronous entry consumer.");
+    const { selected, expected, complete } = await selection(ready, input, options, resources, (error) => controller.abort(error));
+    const metadata = await ledger(ready, options, resources);
+    const counts = new TransferCounters(options.quotas, "export");
+    let accepting = true;
+    let callback;
+    let failure;
+    let subtreeRootSeen = false;
+    const deliver = (raw) => {
+      if (!accepting || callback) {
+        const error = new SandboxOperationError("driver_failure", "Export callbacks must be awaited sequentially within the transfer.");
+        failure ??= { error };
+        return Promise.reject(error);
+      }
+      const actual = Promise.resolve().then(async () => {
+        options.signal.throwIfAborted();
+        const entry = parseTreeMetadata(raw, "bytes");
+        if (selected.kind === "subtree") {
+          if (entry.path === selected.path) {
+            if (entry.kind !== "directory") throw new SandboxOperationError("driver_failure", "The selected subtree root must be a directory.");
+            subtreeRootSeen = true;
+          } else if (!entry.path.startsWith(`${selected.path}/`)) {
+            throw new SandboxOperationError("driver_failure", "Backend exported an entry outside the selected subtree.");
+          }
+        }
+        counts.admit(entry);
+        await metadata.append(entry);
+        if (entry.kind === "directory") await consume(entry, { signal: options.signal });
+        else {
+          const body = new TransferBody(
+            entry.byteLength,
+            options.buffers.chunkBytes,
+            false,
+            options.signal,
+            () => entry.body,
+            (error) => controller.abort(error)
+          );
+          resources.body = body;
+          await consume(Object.freeze({ kind: "file", path: entry.path, byteLength: entry.byteLength, executable: entry.executable, bytes: body }), { signal: options.signal });
+          await resources.finishBody();
+        }
+        options.signal.throwIfAborted();
+      });
+      callback = actual;
+      resources.entered = actual;
+      void actual.then(() => {
+        callback = void 0;
+      }, (error) => {
+        callback = void 0;
+        failure ??= { error };
+      });
+      return actual;
+    };
+    let summary;
+    try {
+      summary = await ready.exportTree(selected, deliver, options);
+    } finally {
+      accepting = false;
+    }
+    if (callback) {
+      failure ??= { error: new SandboxOperationError("driver_failure", "Backend returned while its export consumer was still running.") };
+      controller.abort(failure.error);
+    }
+    await callback?.catch(() => {
+    });
+    if (failure) throw failure.error;
+    await complete?.();
+    await resources.source?.close();
+    resources.source = void 0;
+    await metadata.finish();
+    if (selected.kind === "subtree" && !subtreeRootSeen) throw new SandboxOperationError("driver_failure", "Backend omitted the selected subtree root directory.");
+    if (expected) await verifySelected(expected, metadata);
+    options.signal.throwIfAborted();
+    return counts.verify(summary);
+  });
+}
+export {
+  exportTree,
+  importTree
+};

package/dist/node/directories/closing.d.ts

@@ -0,0 +1,2 @@
+export declare function closeAfter<Value>(perform: () => Promise<Value>, close: () => Promise<void>): Promise<Value>;
+//# sourceMappingURL=closing.d.ts.map

package/dist/node/directories/closing.js

@@ -0,0 +1,19 @@
+async function closeAfter(perform, close) {
+  let outcome;
+  try {
+    outcome = { kind: "returned", value: await perform() };
+  } catch (error) {
+    outcome = { kind: "threw", error };
+  }
+  try {
+    await close();
+  } catch (cleanupError) {
+    if (outcome.kind === "threw") throw new AggregateError([outcome.error, cleanupError], "Filesystem work and native handle closure both failed.", { cause: outcome.error });
+    throw cleanupError;
+  }
+  if (outcome.kind === "threw") throw outcome.error;
+  return outcome.value;
+}
+export {
+  closeAfter
+};

package/dist/node/directories/export.d.ts

@@ -0,0 +1,6 @@
+import type { Sandbox } from '../../contracts.js';
+import type { SandboxTreeSelection, SandboxTransferOptions } from '../../files/types.js';
+import type { SandboxDirectoryExportResult } from './types.js';
+/** Destination is a new exclusive namespace; the published tree is its returned `files` child. */
+export declare function exportSandboxDirectory(sandbox: Sandbox, selection: SandboxTreeSelection, destination: string, options?: SandboxTransferOptions): Promise<SandboxDirectoryExportResult>;
+//# sourceMappingURL=export.d.ts.map

package/dist/node/directories/export.js

@@ -0,0 +1,43 @@
+import { dirname } from "node:path";
+import { SandboxOperationError, SandboxUnsupportedError } from "../../errors.js";
+import { parseTransferOptions } from "../../files/parse.js";
+import { canonicalHostPath, verifyHostDirectory } from "../hostPath.js";
+import { DirectoryStage } from "./stage.js";
+import { capturedTransferOptions } from "./options.js";
+import { SandboxDirectoryCleanupError } from "./types.js";
+async function exportSandboxDirectory(sandbox, selection, destination, options) {
+  const path = canonicalHostPath(destination);
+  const parsed = parseTransferOptions(options);
+  const selected = capturedTransferOptions(parsed);
+  parsed.signal?.throwIfAborted();
+  if (parsed.deadlineAt !== void 0 && parsed.deadlineAt <= Date.now()) throw new SandboxOperationError("deadline_exceeded", "Directory export deadline elapsed before entry.");
+  if (process.platform === "win32") throw new SandboxUnsupportedError("Directory publication requires the qualified POSIX filesystem profile.");
+  const parent = await verifyHostDirectory(dirname(path), parsed.signal);
+  const stage = new DirectoryStage(path, parent, parsed.signal);
+  let outcome;
+  try {
+    await stage.initialize();
+    const summary = await sandbox.exportTree(selection, (entry, input) => stage.consume(entry, input), selected);
+    await stage.publish();
+    outcome = { kind: "returned", summary };
+  } catch (error) {
+    stage.fence(error);
+    outcome = { kind: "threw", error };
+  }
+  try {
+    await stage.close();
+  } catch (cleanupError) {
+    throw new SandboxDirectoryCleanupError(
+      outcome.kind === "threw" ? outcome.error : void 0,
+      cleanupError,
+      path,
+      stage,
+      stage.publishedDirectory
+    );
+  }
+  if (outcome.kind === "threw") throw outcome.error;
+  return Object.freeze({ directory: stage.directory, summary: outcome.summary });
+}
+export {
+  exportSandboxDirectory
+};

package/dist/node/directories/file.d.ts

@@ -0,0 +1,26 @@
+import type { BigIntStats } from 'node:fs';
+export declare class DirectoryFile implements AsyncIterable<Uint8Array> {
+    private readonly path;
+    private readonly fileStats;
+    private readonly ownerSignal;
+    private readonly verifyParents;
+    private file;
+    private pending;
+    private closing;
+    private phase;
+    private signal;
+    private opened;
+    private iterated;
+    private done;
+    private position;
+    private readonly buffer;
+    constructor(path: string, fileStats: BigIntStats, ownerSignal: AbortSignal, chunkBytes: number, verifyParents: () => Promise<void>);
+    open(input: Readonly<{
+        signal: AbortSignal;
+    }>): AsyncIterable<Uint8Array>;
+    [Symbol.asyncIterator](): AsyncIterator<Uint8Array>;
+    private next;
+    close(): Promise<void>;
+    private check;
+}
+//# sourceMappingURL=file.d.ts.map

package/dist/node/directories/file.js

@@ -0,0 +1,104 @@
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { SandboxOperationError, SandboxStateError } from "../../errors.js";
+import { verifyRegularIdentity } from "../hostPath.js";
+class DirectoryFile {
+  constructor(path, fileStats, ownerSignal, chunkBytes, verifyParents) {
+    this.path = path;
+    this.fileStats = fileStats;
+    this.ownerSignal = ownerSignal;
+    this.verifyParents = verifyParents;
+    this.buffer = new Uint8Array(chunkBytes);
+  }
+  file;
+  pending;
+  closing;
+  phase = "ready";
+  signal;
+  opened = false;
+  iterated = false;
+  done = false;
+  position = 0;
+  buffer;
+  open(input) {
+    if (this.opened || this.phase !== "ready") throw new SandboxStateError("Host input files are once-only and transfer scoped.");
+    this.ownerSignal.throwIfAborted();
+    this.signal = AbortSignal.any([this.ownerSignal, input.signal]);
+    this.opened = true;
+    this.phase = "reading";
+    return this;
+  }
+  [Symbol.asyncIterator]() {
+    if (this.iterated || !this.opened) throw new SandboxStateError("Host input bodies admit one iterator after opening.");
+    this.iterated = true;
+    return { next: () => this.next(), return: async () => {
+      await this.close();
+      return { done: true, value: void 0 };
+    } };
+  }
+  next() {
+    if (this.phase !== "reading" || this.pending) return Promise.reject(new SandboxStateError("Host file reads require one active reader."));
+    if (this.done) return Promise.resolve({ done: true, value: void 0 });
+    const actual = (async () => {
+      this.check();
+      if (!this.file) {
+        await this.verifyParents();
+        this.check();
+        this.file = await open(this.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        verifyRegularIdentity(await this.file.stat({ bigint: true }), this.fileStats);
+        await this.verifyParents();
+        verifyRegularIdentity(await lstat(this.path, { bigint: true }), this.fileStats);
+        this.check();
+      }
+      const length = Number(this.fileStats.size);
+      if (this.position === length) {
+        const { bytesRead: bytesRead2 } = await this.file.read(this.buffer, 0, 1, this.position);
+        this.check();
+        if (bytesRead2 !== 0) throw new SandboxOperationError("input_limit", "Host input grew beyond its declared length.");
+        verifyRegularIdentity(await this.file.stat({ bigint: true }), this.fileStats);
+        await this.verifyParents();
+        verifyRegularIdentity(await lstat(this.path, { bigint: true }), this.fileStats);
+        this.check();
+        this.done = true;
+        return { done: true, value: void 0 };
+      }
+      const { bytesRead } = await this.file.read(this.buffer, 0, Math.min(this.buffer.byteLength, length - this.position), this.position);
+      this.check();
+      if (bytesRead === 0) throw new SandboxOperationError("input_limit", "Host input ended before its declared length.");
+      this.position += bytesRead;
+      return { done: false, value: this.buffer.subarray(0, bytesRead) };
+    })();
+    this.pending = actual;
+    void actual.then(() => {
+      this.pending = void 0;
+    }, () => {
+      this.pending = void 0;
+    });
+    return actual;
+  }
+  close() {
+    if (this.phase === "closed") return Promise.resolve();
+    if (this.closing) return this.closing;
+    this.phase = "closing";
+    this.closing = (async () => {
+      await this.pending?.catch(() => {
+      });
+      if (this.file) {
+        await this.file.close();
+        this.file = void 0;
+      }
+      this.phase = "closed";
+    })().finally(() => {
+      this.closing = void 0;
+    });
+    return this.closing;
+  }
+  check() {
+    this.ownerSignal.throwIfAborted();
+    this.signal?.throwIfAborted();
+    if (this.phase !== "reading") throw new SandboxStateError("Host file admission is closed.");
+  }
+}
+export {
+  DirectoryFile
+};

package/dist/node/directories/import.d.ts

@@ -0,0 +1,6 @@
+import type { Sandbox } from '../../contracts.js';
+import type { SandboxTransferSummary } from '../../files/types.js';
+import type { SandboxDirectoryImportOptions } from './types.js';
+/** The caller keeps the hierarchy stable; descriptor checks detect changes but do not create a snapshot. */
+export declare function importSandboxDirectory(sandbox: Sandbox, root: string, input?: SandboxDirectoryImportOptions): Promise<SandboxTransferSummary>;
+//# sourceMappingURL=import.d.ts.map

package/dist/node/directories/import.js

@@ -0,0 +1,38 @@
+import { SandboxUnsupportedError } from "../../errors.js";
+import { invalidInput } from "../../internal/data.js";
+import { parseTransferOptions, transferData } from "../../files/parse.js";
+import { SANDBOX_LIMITS } from "../../policy/limits.js";
+import { canonicalHostPath, verifyHostDirectory } from "../hostPath.js";
+import { DirectorySource } from "./source.js";
+import { capturedTransferOptions } from "./options.js";
+import { SandboxDirectoryCleanupError } from "./types.js";
+async function importSandboxDirectory(sandbox, root, input) {
+  const path = canonicalHostPath(root);
+  const data = input === void 0 ? {} : transferData(input, ["signal", "deadlineAt", "quotas", "chunkBytes"]);
+  const { chunkBytes = SANDBOX_LIMITS.maxTransferChunkBytes, ...transfer } = data;
+  if (typeof chunkBytes !== "number" || !Number.isSafeInteger(chunkBytes) || chunkBytes < 1 || chunkBytes > SANDBOX_LIMITS.maxTransferChunkBytes) {
+    invalidInput("Host file chunkBytes must be between one byte and 64 KiB");
+  }
+  const options = parseTransferOptions(transfer);
+  const selected = capturedTransferOptions(options);
+  if (process.platform === "win32") throw new SandboxUnsupportedError("Directory imports require the qualified POSIX filesystem profile.");
+  options.signal?.throwIfAborted();
+  const metadata = await verifyHostDirectory(path, options.signal);
+  const source = new DirectorySource(path, metadata, chunkBytes, options.signal);
+  let outcome;
+  try {
+    outcome = { kind: "returned", summary: await sandbox.importTree(source, selected) };
+  } catch (error) {
+    outcome = { kind: "threw", error };
+  }
+  try {
+    await source.close();
+  } catch (cleanupError) {
+    throw new SandboxDirectoryCleanupError(outcome.kind === "threw" ? outcome.error : void 0, cleanupError, path, source);
+  }
+  if (outcome.kind === "threw") throw outcome.error;
+  return outcome.summary;
+}
+export {
+  importSandboxDirectory
+};

package/dist/node/directories/options.d.ts

@@ -0,0 +1,4 @@
+import type { ParsedTransferOptions } from '../../files/parse.js';
+import type { SandboxTransferOptions } from '../../files/types.js';
+export declare function capturedTransferOptions(options: ParsedTransferOptions): SandboxTransferOptions;
+//# sourceMappingURL=options.d.ts.map

package/dist/node/directories/options.js

@@ -0,0 +1,10 @@
+function capturedTransferOptions(options) {
+  return Object.freeze({
+    quotas: options.quotas,
+    ...options.signal === void 0 ? {} : { signal: options.signal },
+    ...options.deadlineAt === void 0 ? {} : { deadlineAt: new Date(options.deadlineAt).toISOString() }
+  });
+}
+export {
+  capturedTransferOptions
+};

package/dist/node/directories/ownership.d.ts

@@ -0,0 +1,33 @@
+import type { BigIntStats } from 'node:fs';
+import type { FileHandle } from 'node:fs/promises';
+interface OwnershipRecord {
+    readonly token: string;
+    readonly path: string;
+    readonly kind: 'file' | 'directory';
+    readonly device: string;
+    readonly inode: string;
+    readonly markerDevice: string;
+    readonly markerInode: string;
+    readonly byteLength?: number;
+    readonly executable?: boolean;
+}
+export declare class DirectoryOwnership {
+    private readonly directory;
+    private readonly token;
+    private readonly handles;
+    private pending;
+    constructor(directory: string, token: string);
+    open(path: string, flags: number, mode?: number): Promise<FileHandle>;
+    closeFile(handle: FileHandle): Promise<void>;
+    remember(path: string, fileStats: BigIntStats, kind: 'file' | 'directory', file?: Readonly<{
+        byteLength: number;
+        executable: boolean;
+    }>): Promise<void>;
+    inspect(path: string, fileStats: BigIntStats, kind: 'file' | 'directory'): Promise<OwnershipRecord>;
+    lookup(fileStats: BigIntStats, kind: 'file' | 'directory'): Promise<OwnershipRecord>;
+    forget(fileStats: BigIntStats): Promise<void>;
+    readMarker(path: string): Promise<OwnershipRecord>;
+    closeHandles(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=ownership.d.ts.map