@bun-win32/wevtapi 1.0.0 → 2.0.1

package/AI.md

@@ -53,7 +53,7 @@ const text = new TextDecoder('utf-16').decode(buf).replace(/\0.*$/, '');
 
 - **Pointer** params (`LP*`, `P*`, `Pointer`): pass `buffer.ptr` from a caller-allocated `Buffer`.
 - **Handle** params (`HANDLE`, `HWND`, etc.): pass a `bigint` value.
-- **Out-parameters**: allocate a `Buffer`, pass `.ptr`, read the result after the call.
+- **Out-parameters** carry a direction suffix on the parameter **name** — `_out` for an `_Out_` param (the function writes through it), `_in_out` for `_Inout_` (you seed it, the function updates it); an `_In_` param is bare. Allocate a `Buffer`, pass `.ptr`, read the result after the call.
 
 ```ts
 const out = Buffer.alloc(4);
@@ -63,9 +63,11 @@ const value = out.readUInt32LE(0);
 
 ### Nullability
 
-- `| NULL` in a signature -> pass `null` (optional pointer).
-- `| 0n` in a signature -> pass `0n` (optional handle).
+Nullability is encoded in the **type** via two representation-aware markers — the null sentinel is derived from `T` (`null` for pointer types `LP*`/`P*`, `0n` for handles and by-value addresses):
 
+- `Optional<T>` — the parameter is formally optional (SAL `_*opt_` / `[*, optional]` / `_Reserved_` that still takes a value). Pass a value, or the null sentinel to omit.
+- `Nullable<T>` — a plain `[in]`/`[out]` param whose docs say it can be NULL ("This parameter can be NULL" / "Specify NULL to …", including sizing-call buffers).
+- A **required** param is bare; a **must-be-null reserved** param is typed `NULL`. A by-value **scalar** (`DWORD`/`ULONG`/`UINT`/`BOOL`) is never wrapped — its "optional" means pass `0`/a default.
 ## Errors and Cleanup
 
 Return values are raw. If the Win32 function uses last-error semantics, read via `GetLastError()`. Resource cleanup is your responsibility - same as raw Win32.

package/README.md

@@ -60,3 +60,4 @@ bun run example:channel-report
 
 - Either rely on lazy binding or call `Wevtapi.Preload()`.
 - Windows only. Bun runtime required.
+- **SAL types & naming:** nullability is in the **type** — `Optional<T>` (formally optional, SAL `_*opt_`) and `Nullable<T>` (plain `[in]`/`[out]` the docs say can be NULL), the null sentinel derived from `T` (`null` for pointers `LP*`/`P*`, `0n` for handles/by-value addresses); direction is in the **parameter name** — `_out` (`_Out_`), `_in_out` (`_Inout_`), `_In_` bare. See `AI.md` and the repo `AGENTS.md`.

package/package.json

@@ -1,14 +1,14 @@
 {
-  "author": "Stev Peifer <stev@bell.net>",
+  "author": "Stev Peifer <stev.p@outlook.com>",
   "bugs": {
     "url": "https://github.com/ObscuritySRL/bun-win32/issues"
   },
   "dependencies": {
-    "@bun-win32/core": "1.1.2"
+    "@bun-win32/core": "2.0.1"
   },
   "description": "Zero-dependency, zero-overhead Win32 WEVTAPI bindings for Bun (FFI) on Windows.",
   "devDependencies": {
-    "@bun-win32/kernel32": "1.0.21",
+    "@bun-win32/kernel32": "2.0.1",
     "@types/bun": "latest"
   },
   "exports": {
@@ -28,7 +28,7 @@
     "directory": "packages/wevtapi"
   },
   "type": "module",
-  "version": "1.0.0",
+  "version": "2.0.1",
   "main": "./index.ts",
   "keywords": [
     "bun",

package/structs/Wevtapi.ts

@@ -28,7 +28,8 @@ import type {
   LONGLONG,
   LPCWSTR,
   LPWSTR,
-  NULL,
+  Nullable,
+  Optional,
   PDWORD,
   PEVT_HANDLE,
   PEVT_RPC_LOGIN,
@@ -100,17 +101,17 @@ class Wevtapi extends Win32 {
   } as const satisfies Record<string, FFIFunction>;
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtarchiveexportedlog
-  public static EvtArchiveExportedLog(Session: EVT_HANDLE | 0n, LogFilePath: LPCWSTR, Locale: LCID, Flags: DWORD): BOOL {
+  public static EvtArchiveExportedLog(Session: Optional<EVT_HANDLE>, LogFilePath: LPCWSTR, Locale: LCID, Flags: DWORD): BOOL {
     return Wevtapi.Load('EvtArchiveExportedLog')(Session, LogFilePath, Locale, Flags);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtcancel
-  public static EvtCancel(Object: EVT_HANDLE | 0n): BOOL {
+  public static EvtCancel(Object: Optional<EVT_HANDLE>): BOOL {
     return Wevtapi.Load('EvtCancel')(Object);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtclearlog
-  public static EvtClearLog(Session: EVT_HANDLE | 0n, ChannelPath: LPCWSTR, TargetFilePath: LPCWSTR | NULL, Flags: DWORD): BOOL {
+  public static EvtClearLog(Session: Optional<EVT_HANDLE>, ChannelPath: LPCWSTR, TargetFilePath: Optional<LPCWSTR>, Flags: DWORD): BOOL {
     return Wevtapi.Load('EvtClearLog')(Session, ChannelPath, TargetFilePath, Flags);
   }
 
@@ -120,43 +121,50 @@ class Wevtapi extends Win32 {
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtcreatebookmark
-  public static EvtCreateBookmark(BookmarkXml: LPCWSTR | NULL): EVT_HANDLE {
+  public static EvtCreateBookmark(BookmarkXml: Optional<LPCWSTR>): EVT_HANDLE {
     return Wevtapi.Load('EvtCreateBookmark')(BookmarkXml);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtcreaterendercontext
-  public static EvtCreateRenderContext(ValuePathsCount: DWORD, ValuePaths: PLPCWSTR | NULL, Flags: EvtRenderContextFlags): EVT_HANDLE {
+  public static EvtCreateRenderContext(ValuePathsCount: DWORD, ValuePaths: Optional<PLPCWSTR>, Flags: EvtRenderContextFlags): EVT_HANDLE {
     return Wevtapi.Load('EvtCreateRenderContext')(ValuePathsCount, ValuePaths, Flags);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtexportlog
-  public static EvtExportLog(Session: EVT_HANDLE | 0n, Path: LPCWSTR | NULL, Query: LPCWSTR | NULL, TargetFilePath: LPCWSTR, Flags: EvtExportLogFlags): BOOL {
+  public static EvtExportLog(Session: Optional<EVT_HANDLE>, Path: Optional<LPCWSTR>, Query: Optional<LPCWSTR>, TargetFilePath: LPCWSTR, Flags: EvtExportLogFlags): BOOL {
     return Wevtapi.Load('EvtExportLog')(Session, Path, Query, TargetFilePath, Flags);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtformatmessage
   public static EvtFormatMessage(
-    PublisherMetadata: EVT_HANDLE | 0n,
-    Event: EVT_HANDLE | 0n,
+    PublisherMetadata: Optional<EVT_HANDLE>,
+    Event: Optional<EVT_HANDLE>,
     MessageId: DWORD,
     ValueCount: DWORD,
-    Values: PEVT_VARIANT | NULL,
+    Values: Optional<PEVT_VARIANT>,
     Flags: EvtFormatMessageFlags,
     BufferSize: DWORD,
-    Buffer: LPWSTR | NULL,
-    BufferUsed: PDWORD,
+    Buffer_out: Optional<LPWSTR>,
+    BufferUsed_out: PDWORD,
   ): BOOL {
-    return Wevtapi.Load('EvtFormatMessage')(PublisherMetadata, Event, MessageId, ValueCount, Values, Flags, BufferSize, Buffer, BufferUsed);
+    return Wevtapi.Load('EvtFormatMessage')(PublisherMetadata, Event, MessageId, ValueCount, Values, Flags, BufferSize, Buffer_out, BufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgetchannelconfigproperty
-  public static EvtGetChannelConfigProperty(ChannelConfig: EVT_HANDLE, PropertyId: EvtChannelConfigPropertyId, Flags: DWORD, PropertyValueBufferSize: DWORD, PropertyValueBuffer: PEVT_VARIANT | NULL, PropertyValueBufferUsed: PDWORD): BOOL {
-    return Wevtapi.Load('EvtGetChannelConfigProperty')(ChannelConfig, PropertyId, Flags, PropertyValueBufferSize, PropertyValueBuffer, PropertyValueBufferUsed);
+  public static EvtGetChannelConfigProperty(
+    ChannelConfig: EVT_HANDLE,
+    PropertyId: EvtChannelConfigPropertyId,
+    Flags: DWORD,
+    PropertyValueBufferSize: DWORD,
+    PropertyValueBuffer_out: Optional<PEVT_VARIANT>,
+    PropertyValueBufferUsed_out: PDWORD,
+  ): BOOL {
+    return Wevtapi.Load('EvtGetChannelConfigProperty')(ChannelConfig, PropertyId, Flags, PropertyValueBufferSize, PropertyValueBuffer_out, PropertyValueBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgeteventinfo
-  public static EvtGetEventInfo(Event: EVT_HANDLE, PropertyId: EvtEventPropertyId, PropertyValueBufferSize: DWORD, PropertyValueBuffer: PEVT_VARIANT | NULL, PropertyValueBufferUsed: PDWORD): BOOL {
-    return Wevtapi.Load('EvtGetEventInfo')(Event, PropertyId, PropertyValueBufferSize, PropertyValueBuffer, PropertyValueBufferUsed);
+  public static EvtGetEventInfo(Event: EVT_HANDLE, PropertyId: EvtEventPropertyId, PropertyValueBufferSize: DWORD, PropertyValueBuffer_out: Optional<PEVT_VARIANT>, PropertyValueBufferUsed_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtGetEventInfo')(Event, PropertyId, PropertyValueBufferSize, PropertyValueBuffer_out, PropertyValueBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgeteventmetadataproperty
@@ -165,20 +173,20 @@ class Wevtapi extends Win32 {
     PropertyId: EvtEventMetadataPropertyId,
     Flags: DWORD,
     EventMetadataPropertyBufferSize: DWORD,
-    EventMetadataPropertyBuffer: PEVT_VARIANT | NULL,
-    EventMetadataPropertyBufferUsed: PDWORD,
+    EventMetadataPropertyBuffer_out: Optional<PEVT_VARIANT>,
+    EventMetadataPropertyBufferUsed_out: PDWORD,
   ): BOOL {
-    return Wevtapi.Load('EvtGetEventMetadataProperty')(EventMetadata, PropertyId, Flags, EventMetadataPropertyBufferSize, EventMetadataPropertyBuffer, EventMetadataPropertyBufferUsed);
+    return Wevtapi.Load('EvtGetEventMetadataProperty')(EventMetadata, PropertyId, Flags, EventMetadataPropertyBufferSize, EventMetadataPropertyBuffer_out, EventMetadataPropertyBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgetextendedstatus
-  public static EvtGetExtendedStatus(BufferSize: DWORD, Buffer: LPWSTR | NULL, BufferUsed: PDWORD): DWORD {
-    return Wevtapi.Load('EvtGetExtendedStatus')(BufferSize, Buffer, BufferUsed);
+  public static EvtGetExtendedStatus(BufferSize: DWORD, Buffer_out: Optional<LPWSTR>, BufferUsed_out: PDWORD): DWORD {
+    return Wevtapi.Load('EvtGetExtendedStatus')(BufferSize, Buffer_out, BufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgetloginfo
-  public static EvtGetLogInfo(Log: EVT_HANDLE, PropertyId: EvtLogPropertyId, PropertyValueBufferSize: DWORD, PropertyValueBuffer: PEVT_VARIANT | NULL, PropertyValueBufferUsed: PDWORD): BOOL {
-    return Wevtapi.Load('EvtGetLogInfo')(Log, PropertyId, PropertyValueBufferSize, PropertyValueBuffer, PropertyValueBufferUsed);
+  public static EvtGetLogInfo(Log: EVT_HANDLE, PropertyId: EvtLogPropertyId, PropertyValueBufferSize: DWORD, PropertyValueBuffer_out: Optional<PEVT_VARIANT>, PropertyValueBufferUsed_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtGetLogInfo')(Log, PropertyId, PropertyValueBufferSize, PropertyValueBuffer_out, PropertyValueBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgetobjectarrayproperty
@@ -188,15 +196,15 @@ class Wevtapi extends Win32 {
     ArrayIndex: DWORD,
     Flags: DWORD,
     PropertyValueBufferSize: DWORD,
-    PropertyValueBuffer: PEVT_VARIANT | NULL,
-    PropertyValueBufferUsed: PDWORD,
+    PropertyValueBuffer_out: Optional<PEVT_VARIANT>,
+    PropertyValueBufferUsed_out: PDWORD,
   ): BOOL {
-    return Wevtapi.Load('EvtGetObjectArrayProperty')(ObjectArray, PropertyId, ArrayIndex, Flags, PropertyValueBufferSize, PropertyValueBuffer, PropertyValueBufferUsed);
+    return Wevtapi.Load('EvtGetObjectArrayProperty')(ObjectArray, PropertyId, ArrayIndex, Flags, PropertyValueBufferSize, PropertyValueBuffer_out, PropertyValueBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgetobjectarraysize
-  public static EvtGetObjectArraySize(ObjectArray: EVT_OBJECT_ARRAY_PROPERTY_HANDLE, ObjectArraySize: PDWORD): BOOL {
-    return Wevtapi.Load('EvtGetObjectArraySize')(ObjectArray, ObjectArraySize);
+  public static EvtGetObjectArraySize(ObjectArray: EVT_OBJECT_ARRAY_PROPERTY_HANDLE, ObjectArraySize_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtGetObjectArraySize')(ObjectArray, ObjectArraySize_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgetpublishermetadataproperty
@@ -205,25 +213,25 @@ class Wevtapi extends Win32 {
     PropertyId: EvtPublisherMetadataPropertyId,
     Flags: DWORD,
     PublisherMetadataPropertyBufferSize: DWORD,
-    PublisherMetadataPropertyBuffer: PEVT_VARIANT | NULL,
-    PublisherMetadataPropertyBufferUsed: PDWORD,
+    PublisherMetadataPropertyBuffer_out: Optional<PEVT_VARIANT>,
+    PublisherMetadataPropertyBufferUsed_out: PDWORD,
   ): BOOL {
-    return Wevtapi.Load('EvtGetPublisherMetadataProperty')(PublisherMetadata, PropertyId, Flags, PublisherMetadataPropertyBufferSize, PublisherMetadataPropertyBuffer, PublisherMetadataPropertyBufferUsed);
+    return Wevtapi.Load('EvtGetPublisherMetadataProperty')(PublisherMetadata, PropertyId, Flags, PublisherMetadataPropertyBufferSize, PublisherMetadataPropertyBuffer_out, PublisherMetadataPropertyBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtgetqueryinfo
-  public static EvtGetQueryInfo(QueryOrSubscription: EVT_HANDLE, PropertyId: EvtQueryPropertyId, PropertyValueBufferSize: DWORD, PropertyValueBuffer: PEVT_VARIANT | NULL, PropertyValueBufferUsed: PDWORD): BOOL {
-    return Wevtapi.Load('EvtGetQueryInfo')(QueryOrSubscription, PropertyId, PropertyValueBufferSize, PropertyValueBuffer, PropertyValueBufferUsed);
+  public static EvtGetQueryInfo(QueryOrSubscription: EVT_HANDLE, PropertyId: EvtQueryPropertyId, PropertyValueBufferSize: DWORD, PropertyValueBuffer_out: Optional<PEVT_VARIANT>, PropertyValueBufferUsed_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtGetQueryInfo')(QueryOrSubscription, PropertyId, PropertyValueBufferSize, PropertyValueBuffer_out, PropertyValueBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtnext
-  public static EvtNext(ResultSet: EVT_HANDLE, EventsSize: DWORD, Events: PEVT_HANDLE, Timeout: DWORD, Flags: DWORD, Returned: PDWORD): BOOL {
-    return Wevtapi.Load('EvtNext')(ResultSet, EventsSize, Events, Timeout, Flags, Returned);
+  public static EvtNext(ResultSet: EVT_HANDLE, EventsSize: DWORD, Events_out: PEVT_HANDLE, Timeout: DWORD, Flags: DWORD, Returned_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtNext')(ResultSet, EventsSize, Events_out, Timeout, Flags, Returned_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtnextchannelpath
-  public static EvtNextChannelPath(ChannelEnum: EVT_HANDLE, ChannelPathBufferSize: DWORD, ChannelPathBuffer: LPWSTR | NULL, ChannelPathBufferUsed: PDWORD): BOOL {
-    return Wevtapi.Load('EvtNextChannelPath')(ChannelEnum, ChannelPathBufferSize, ChannelPathBuffer, ChannelPathBufferUsed);
+  public static EvtNextChannelPath(ChannelEnum: EVT_HANDLE, ChannelPathBufferSize: DWORD, ChannelPathBuffer_out: Optional<LPWSTR>, ChannelPathBufferUsed_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtNextChannelPath')(ChannelEnum, ChannelPathBufferSize, ChannelPathBuffer_out, ChannelPathBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtnexteventmetadata
@@ -232,17 +240,17 @@ class Wevtapi extends Win32 {
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtnextpublisherid
-  public static EvtNextPublisherId(PublisherEnum: EVT_HANDLE, PublisherIdBufferSize: DWORD, PublisherIdBuffer: LPWSTR | NULL, PublisherIdBufferUsed: PDWORD): BOOL {
-    return Wevtapi.Load('EvtNextPublisherId')(PublisherEnum, PublisherIdBufferSize, PublisherIdBuffer, PublisherIdBufferUsed);
+  public static EvtNextPublisherId(PublisherEnum: EVT_HANDLE, PublisherIdBufferSize: DWORD, PublisherIdBuffer_out: Optional<LPWSTR>, PublisherIdBufferUsed_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtNextPublisherId')(PublisherEnum, PublisherIdBufferSize, PublisherIdBuffer_out, PublisherIdBufferUsed_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopenchannelconfig
-  public static EvtOpenChannelConfig(Session: EVT_HANDLE | 0n, ChannelPath: LPCWSTR, Flags: DWORD): EVT_HANDLE {
+  public static EvtOpenChannelConfig(Session: Optional<EVT_HANDLE>, ChannelPath: LPCWSTR, Flags: DWORD): EVT_HANDLE {
     return Wevtapi.Load('EvtOpenChannelConfig')(Session, ChannelPath, Flags);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopenchannelenum
-  public static EvtOpenChannelEnum(Session: EVT_HANDLE | 0n, Flags: DWORD): EVT_HANDLE {
+  public static EvtOpenChannelEnum(Session: Optional<EVT_HANDLE>, Flags: DWORD): EVT_HANDLE {
     return Wevtapi.Load('EvtOpenChannelEnum')(Session, Flags);
   }
 
@@ -252,17 +260,17 @@ class Wevtapi extends Win32 {
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopenlog
-  public static EvtOpenLog(Session: EVT_HANDLE | 0n, Path: LPCWSTR, Flags: EvtOpenLogFlags): EVT_HANDLE {
+  public static EvtOpenLog(Session: Optional<EVT_HANDLE>, Path: LPCWSTR, Flags: EvtOpenLogFlags): EVT_HANDLE {
     return Wevtapi.Load('EvtOpenLog')(Session, Path, Flags);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopenpublisherenum
-  public static EvtOpenPublisherEnum(Session: EVT_HANDLE | 0n, Flags: DWORD): EVT_HANDLE {
+  public static EvtOpenPublisherEnum(Session: Optional<EVT_HANDLE>, Flags: DWORD): EVT_HANDLE {
     return Wevtapi.Load('EvtOpenPublisherEnum')(Session, Flags);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtopenpublishermetadata
-  public static EvtOpenPublisherMetadata(Session: EVT_HANDLE | 0n, PublisherId: LPCWSTR, LogFilePath: LPCWSTR | NULL, Locale: LCID, Flags: DWORD): EVT_HANDLE {
+  public static EvtOpenPublisherMetadata(Session: Optional<EVT_HANDLE>, PublisherId: LPCWSTR, LogFilePath: Optional<LPCWSTR>, Locale: LCID, Flags: DWORD): EVT_HANDLE {
     return Wevtapi.Load('EvtOpenPublisherMetadata')(Session, PublisherId, LogFilePath, Locale, Flags);
   }
 
@@ -272,13 +280,13 @@ class Wevtapi extends Win32 {
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtquery
-  public static EvtQuery(Session: EVT_HANDLE | 0n, Path: LPCWSTR | NULL, Query: LPCWSTR | NULL, Flags: EvtQueryFlags): EVT_HANDLE {
+  public static EvtQuery(Session: Optional<EVT_HANDLE>, Path: Optional<LPCWSTR>, Query: Optional<LPCWSTR>, Flags: EvtQueryFlags): EVT_HANDLE {
     return Wevtapi.Load('EvtQuery')(Session, Path, Query, Flags);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtrender
-  public static EvtRender(Context: EVT_HANDLE | 0n, Fragment: EVT_HANDLE, Flags: EvtRenderFlags, BufferSize: DWORD, Buffer: PVOID | NULL, BufferUsed: PDWORD, PropertyCount: PDWORD): BOOL {
-    return Wevtapi.Load('EvtRender')(Context, Fragment, Flags, BufferSize, Buffer, BufferUsed, PropertyCount);
+  public static EvtRender(Context: Optional<EVT_HANDLE>, Fragment: EVT_HANDLE, Flags: EvtRenderFlags, BufferSize: DWORD, Buffer_out: Optional<PVOID>, BufferUsed_out: PDWORD, PropertyCount_out: PDWORD): BOOL {
+    return Wevtapi.Load('EvtRender')(Context, Fragment, Flags, BufferSize, Buffer_out, BufferUsed_out, PropertyCount_out);
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtsavechannelconfig
@@ -287,7 +295,7 @@ class Wevtapi extends Win32 {
   }
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtseek
-  public static EvtSeek(ResultSet: EVT_HANDLE, Position: LONGLONG, Bookmark: EVT_HANDLE | 0n, Timeout: DWORD, Flags: EvtSeekFlags): BOOL {
+  public static EvtSeek(ResultSet: EVT_HANDLE, Position: LONGLONG, Bookmark: Optional<EVT_HANDLE>, Timeout: DWORD, Flags: EvtSeekFlags): BOOL {
     return Wevtapi.Load('EvtSeek')(ResultSet, Position, Bookmark, Timeout, Flags);
   }
 
@@ -298,13 +306,13 @@ class Wevtapi extends Win32 {
 
   // https://learn.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtsubscribe
   public static EvtSubscribe(
-    Session: EVT_HANDLE | 0n,
-    SignalEvent: HANDLE | 0n,
-    ChannelPath: LPCWSTR | NULL,
-    Query: LPCWSTR | NULL,
-    Bookmark: EVT_HANDLE | 0n,
-    Context: PVOID | NULL,
-    Callback: EVT_SUBSCRIBE_CALLBACK | NULL,
+    Session: Optional<EVT_HANDLE>,
+    SignalEvent: Optional<HANDLE>,
+    ChannelPath: Optional<LPCWSTR>,
+    Query: Optional<LPCWSTR>,
+    Bookmark: Optional<EVT_HANDLE>,
+    Context: Nullable<PVOID>,
+    Callback: Nullable<EVT_SUBSCRIBE_CALLBACK>,
     Flags: EvtSubscribeFlags,
   ): EVT_HANDLE {
     return Wevtapi.Load('EvtSubscribe')(Session, SignalEvent, ChannelPath, Query, Bookmark, Context, Callback, Flags);

package/types/Wevtapi.ts

@@ -1,7 +1,7 @@
 import type { Pointer } from 'bun:ffi';
 
 import type { DWORD, HANDLE } from '@bun-win32/core';
-export type { BOOL, DWORD, HANDLE, LPCWSTR, LPWSTR, NULL, PDWORD, PVOID } from '@bun-win32/core';
+export type { BOOL, DWORD, HANDLE, LPCWSTR, LPWSTR, NULL, Nullable, Optional, PDWORD, PVOID } from '@bun-win32/core';
 
 export const EVT_ALL_ACCESS = 0x0000_0007;
 export const EVT_CLEAR_ACCESS = 0x0000_0004;