@openclaw/feishu 2026.9.7 → 2026.10.1-beta.1

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent-windows.js

@@ -1,28 +1,21 @@
 import fsSync, {} from "node:fs";
-import path from "node:path";
-import { assertDirectoryIdentitySync, inspectDirectoryIdentitySync, } from "./directory-guard.js";
+import { assertDirectoryIdentitySync, } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { openNativeParentAdmission } from "./native-parent-admission.js";
-import { captureNativeFdClose } from "./native-binding.js";
 import { inspectNativeDirectoryObservation } from "./native-directory-observation.js";
-import { createPathSegmentRoute, joinPathSegmentRoute } from "./path-segment-route.js";
 import { isSymlinkOpenError } from "./path.js";
 import { checkedMutationDirectory } from "./pinned-mutation-observation.js";
-import { canReuseParentWithMutationAssertion } from "./root-write-lock-binding.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { createSuppressedError } from "./suppressed-error.js";
-function assertParentCurrent(parent) {
-    const current = inspectFileIdentitySync(() => fsSync.fstatSync(parent.fd, { bigint: true }), parent.guard.stat);
+export function assertWindowsPolicyParentCurrent(parent) {
+    inspectFileIdentitySync(() => fsSync.fstatSync(parent.fd, { bigint: true }), parent.guard.stat);
     assertDirectoryIdentitySync(parent.guard.dir, {
         dev: parent.guard.stat.dev,
         ino: parent.guard.stat.ino,
         realPath: parent.guard.realPath,
     });
-    return current;
 }
-function closeAfterFailure(closeFd, fd, failure, report = false) {
-    if (fd === undefined)
-        return;
+export function closeWindowsPolicyParentAfterFailure(closeFd, fd, failure, report = false) {
     try {
         closeFd(fd);
     }
@@ -33,177 +26,37 @@ function closeAfterFailure(closeFd, fd, failure, report = false) {
                 : error;
     }
 }
-export async function capturePolicyAwareWindowsParent(binding, params, rootAdmission) {
-    const closeFd = captureNativeFdClose(binding);
-    let session;
-    function parentObservation(fd, guard) {
-        return checkedMutationDirectory(guard.dir, guard.realPath, guard.stat, typeof binding.observeDirectory === "function" ? () => {
-            const stat = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), guard.stat);
-            let observed;
-            try {
-                observed = inspectNativeDirectoryObservation(binding, guard.dir, stat);
-            }
-            catch (error) {
-                if (error?.code === "OBSERVATION_UNAVAILABLE")
-                    return undefined;
-                throw error;
-            }
-            return { canonicalPath: observed.realPath,
-                identity: { dev: stat.dev, ino: stat.ino, mode: stat.mode, nlink: stat.nlink } };
-        } : undefined);
-    }
-    async function openParent(fd, parentPath, relativePath) {
-        try {
-            const admitted = await openNativeParentAdmission(binding, {
-                ...rootAdmission,
-                root: { fd },
-                rootPath: parentPath,
-                // Policy fences retain every identity bit even with a legacy numeric root.
-                exactRoot: true,
-            }, relativePath, "native-directory");
-            const guard = { ...admitted.guard, stat: admitted.guard.stat };
-            return { fd: admitted.fd, guard, observation: parentObservation(admitted.fd, guard) };
-        }
-        catch (error) {
-            if (!isSymlinkOpenError(error))
-                throw error;
-            throw new FsSafeError(params.mutationAdmission.rejectParentSymlinks ? "symlink" : "path-mismatch", "native write parent changed during policy admission", { cause: error instanceof Error ? error : undefined });
-        }
-    }
-    async function authorize(targetPath, mutationPath = targetPath, phase = "parent") {
-        const request = Object.freeze({ targetPath, mutationPath, phase });
-        return await (session ? session.authorize(request) : params.mutationAdmission.authorize(request));
-    }
-    // Existing complete parents need one open and one target admission. Exact
-    // parent denies apply only to creation, never to merely using a directory.
-    let complete;
-    try {
-        complete = await openParent(rootAdmission.root.fd, params.rootPath, params.relativeParentPath);
-    }
-    catch (error) {
-        if (error?.code !== "ENOENT" || !params.mkdir)
-            throw error;
-    }
-    if (complete) {
+export function windowsParentObservation(binding, fd, guard) {
+    return checkedMutationDirectory(guard.dir, guard.realPath, guard.stat, typeof binding.observeDirectory === "function" ? () => {
+        const stat = inspectFileIdentitySync(() => fsSync.fstatSync(fd, { bigint: true }), guard.stat);
+        let observed;
         try {
-            await authorize(path.join(complete.guard.realPath, params.basename));
-            assertParentCurrent(complete);
-            return complete;
+            observed = inspectNativeDirectoryObservation(binding, guard.dir, stat);
         }
         catch (error) {
-            closeAfterFailure(closeFd, complete.fd, { error }, rootAdmission.reportCloseErrors);
+            if (error?.code === "OBSERVATION_UNAVAILABLE")
+                return undefined;
             throw error;
         }
-    }
-    const segments = params.relativeParentPath.split("/").filter(Boolean);
-    const route = createPathSegmentRoute(segments);
-    const rootStat = inspectDirectoryIdentitySync(params.rootPath, inspectFileIdentitySync(() => fsSync.fstatSync(rootAdmission.root.fd, { bigint: true })));
-    let current = {
-        fd: rootAdmission.root.fd,
-        guard: { dir: params.rootPath, realPath: params.rootPath, stat: rootStat },
-        observation: parentObservation(rootAdmission.root.fd, {
-            dir: params.rootPath, realPath: params.rootPath, stat: rootStat,
-        }),
-    };
-    let ownedFd;
-    let failure;
-    const initialTarget = joinPathSegmentRoute(params.rootPath, route, 0, params.basename);
-    if (canReuseParentWithMutationAssertion(params.assertBeforeMutation, params.rootPath, initialTarget)) {
-        session = params.mutationAdmission?.beginNativeParentWalk?.() ??
-            params.mutationAdmission?.beginSharedParentWalk?.();
-        if (session && session.retainedTargetPath !== initialTarget) {
-            session.dispose();
-            session = undefined;
-        }
-    }
+        return { canonicalPath: observed.realPath,
+            identity: { dev: stat.dev, ino: stat.ino, mode: stat.mode, nlink: stat.nlink } };
+    } : undefined);
+}
+export async function openWindowsPolicyParent(binding, params, rootAdmission, fd, parentPath, relativePath) {
     try {
-        for (let index = 0; index < segments.length; index += 1) {
-            const segment = segments[index];
-            const parentPath = current.guard.realPath;
-            let child;
-            let createdByMkdir = false;
-            let createReceipt;
-            try {
-                child = await openParent(current.fd, parentPath, segment);
-            }
-            catch (error) {
-                if (error?.code !== "ENOENT")
-                    throw error;
-                // The request admits both the prospective leaf and this missing direct
-                // child. A deeper denial can leave already admitted ancestors intact.
-                const targetPath = session?.retainedTargetPath ??
-                    joinPathSegmentRoute(parentPath, route, index, params.basename);
-                const mutationPath = path.join(parentPath, segment);
-                const request = Object.freeze({ targetPath, mutationPath, phase: "parent-create" });
-                createReceipt = session?.tryAuthorizeAtParent(request, current.observation);
-                if (!createReceipt) {
-                    createReceipt = await authorize(targetPath, mutationPath, "parent-create");
-                    assertParentCurrent(current);
-                }
-                if (params.assertBeforeMutation) {
-                    // Opaque callbacks retain their post-callback descriptor/path fence.
-                    params.assertBeforeMutation();
-                    assertParentCurrent(current);
-                }
-                // Synchronous session admission already ends at the exact parent fence.
-                const mkdirChild = binding.mkdirChildBeneath;
-                if (typeof mkdirChild !== "function") {
-                    throw new FsSafeError("helper-unavailable", "native direct-child parent creation is unavailable");
-                }
-                createdByMkdir = mkdirChild.call(binding, current.fd, segment, 0o777) === true;
-                child = await openParent(current.fd, parentPath, segment);
-            }
-            try {
-                const targetPath = joinPathSegmentRoute(child.guard.realPath, route, index + 1, params.basename);
-                if (session && targetPath !== session.retainedTargetPath) {
-                    session.dispose();
-                    session = undefined;
-                }
-                let evidence;
-                if (session && createdByMkdir && createReceipt) {
-                    try {
-                        evidence = Object.freeze({
-                            admission: createReceipt,
-                            parent: parentObservation(current.fd, { ...current.guard,
-                                stat: inspectFileIdentitySync(() => fsSync.fstatSync(current.fd, { bigint: true }), current.guard.stat),
-                            }),
-                            child: child.observation,
-                        });
-                    }
-                    catch {
-                        // Incomplete optional evidence returns to ordered admission below.
-                    }
-                }
-                // Advancement refreshes both named directories after all Root/policy
-                // observations; these receipts supply expectations, not cached authority.
-                const advanced = evidence && session.advanceCreatedDirectory(evidence);
-                if (!advanced) {
-                    await authorize(targetPath);
-                    assertParentCurrent(child);
-                }
-            }
-            catch (error) {
-                closeAfterFailure(closeFd, child.fd, { error }, rootAdmission.reportCloseErrors);
-                throw error;
-            }
-            const previousFd = ownedFd;
-            current = child;
-            ownedFd = child.fd;
-            if (previousFd !== undefined)
-                closeFd(previousFd);
-        }
-        if (ownedFd === undefined) {
-            throw new FsSafeError("path-mismatch", "native write parent admission did not complete");
-        }
-        ownedFd = undefined;
-        return current;
+        const admitted = await openNativeParentAdmission(binding, {
+            ...rootAdmission,
+            root: { fd },
+            rootPath: parentPath,
+            // Policy fences retain every identity bit even with a legacy numeric root.
+            exactRoot: true,
+        }, relativePath, "native-directory");
+        const guard = { ...admitted.guard, stat: admitted.guard.stat };
+        return { fd: admitted.fd, guard, observation: windowsParentObservation(binding, admitted.fd, guard) };
     }
     catch (error) {
-        failure = { error };
-        throw error;
-    }
-    finally {
-        session?.dispose();
-        closeAfterFailure(closeFd, ownedFd, failure, rootAdmission.reportCloseErrors);
+        if (!isSymlinkOpenError(error))
+            throw error;
+        throw new FsSafeError(params.mutationAdmission.rejectParentSymlinks ? "symlink" : "path-mismatch", "native write parent changed during policy admission", { cause: error instanceof Error ? error : undefined });
     }
 }

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent.d.ts

@@ -0,0 +1,15 @@
+import { type BigIntStats } from "node:fs";
+import { type AsyncDirectoryGuard } from "./directory-guard.js";
+import type { NativeBinding } from "./native.js";
+import type { NativeRootAdmission } from "./native-parent-admission.js";
+import type { PinnedWriteParams } from "./pinned-write-types.js";
+import { describeStagedDirectory, type PolicyStagedDirectory } from "./staged-directory.js";
+import { type MutationDirectoryObservation } from "./pinned-mutation-observation.js";
+export type NativePolicyParent = {
+    fd: number;
+    guard: AsyncDirectoryGuard<BigIntStats>;
+    observation: MutationDirectoryObservation;
+    stagedDirectory?: ReturnType<typeof describeStagedDirectory>;
+    policyDirectory?: PolicyStagedDirectory;
+};
+export declare function capturePolicyAwareNativeParent(binding: NativeBinding, params: PinnedWriteParams, rootAdmission: NativeRootAdmission, windows: boolean, directoryFlags: number, fuseChildCreation?: boolean): Promise<NativePolicyParent>;

package/node_modules/@openclaw/fs-safe/dist/native-policy-parent.js

@@ -0,0 +1,418 @@
+var __addDisposableResource = (this && this.__addDisposableResource) || function (env, value, async) {
+    if (value !== null && value !== void 0) {
+        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
+        var dispose, inner;
+        if (async) {
+            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
+            dispose = value[Symbol.asyncDispose];
+        }
+        if (dispose === void 0) {
+            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
+            dispose = value[Symbol.dispose];
+            if (async) inner = dispose;
+        }
+        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
+        if (inner) dispose = function() { try { inner.call(this); } catch (e) { return Promise.reject(e); } };
+        env.stack.push({ value: value, dispose: dispose, async: async });
+    }
+    else if (async) {
+        env.stack.push({ async: true });
+    }
+    return value;
+};
+var __disposeResources = (this && this.__disposeResources) || (function (SuppressedError) {
+    return function (env) {
+        function fail(e) {
+            env.error = env.hasError ? new SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
+            env.hasError = true;
+        }
+        var r, s = 0;
+        function next() {
+            while (r = env.stack.pop()) {
+                try {
+                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
+                    if (r.dispose) {
+                        var result = r.dispose.call(r.value);
+                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) { fail(e); return next(); });
+                    }
+                    else s |= 1;
+                }
+                catch (e) {
+                    fail(e);
+                }
+            }
+            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
+            if (env.hasError) throw env.error;
+        }
+        return next();
+    };
+})(typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+});
+import fsSync, {} from "node:fs";
+import path from "node:path";
+import { inspectDirectoryIdentity, inspectDirectoryIdentitySync, } from "./directory-guard.js";
+import { FsSafeError } from "./errors.js";
+import { captureNativeFdClose } from "./native-binding.js";
+import { NativePolicyDirectoryMismatch } from "./native-policy-directory-observation.js";
+import { assertWindowsPolicyParentCurrent, closeWindowsPolicyParentAfterFailure, openWindowsPolicyParent, windowsParentObservation, } from "./native-policy-parent-windows.js";
+import { assertPolicyStagedDirectoryCurrent, assertStagedDirectoryCurrent, describePolicyStagedDirectory, describeStagedDirectory, refreshPolicyStagedDirectoryObservation, } from "./staged-directory.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+import { realpathSync } from "./realpath.js";
+import { errorCauseOptions } from "./root-errors.js";
+import { isNotFoundPathError, isSymlinkOpenError } from "./path.js";
+import { checkedMutationDirectory, } from "./pinned-mutation-observation.js";
+import { createPathSegmentRoute, joinPathSegmentRoute, sameAbsolutePath } from "./path-segment-route.js";
+import { canReuseParentWithMutationAssertion } from "./root-write-lock-binding.js";
+function mkdirPosixPolicyChild(binding, parentFd, basename) {
+    if (!basename || basename === "." || basename === ".." || basename.includes("/") ||
+        basename.includes("\0") || (process.platform === "win32" && basename.includes("\\"))) {
+        throw new FsSafeError("invalid-path", "native parent creation requires one direct-child basename");
+    }
+    const mkdirChild = binding.mkdirChildBeneath;
+    if (typeof mkdirChild === "function") {
+        const created = mkdirChild.call(binding, parentFd, basename, 0o777);
+        if (typeof created === "boolean")
+            return created;
+    }
+    binding.mkdirBeneath(parentFd, basename, 0o777);
+    return false;
+}
+function normalizePosixParentOpenError(error, params) {
+    if (!isSymlinkOpenError(error))
+        return error;
+    return params.mutationAdmission?.rejectParentSymlinks
+        ? new FsSafeError("symlink", "symlink path component not allowed", errorCauseOptions(error))
+        : new FsSafeError("path-mismatch", "native write parent changed during policy admission", errorCauseOptions(error));
+}
+async function describePosixParent(fd, pathname) {
+    const parentPath = realpathSync.native(pathname);
+    const stagedDirectory = describeStagedDirectory(fd, parentPath);
+    const stat = await inspectDirectoryIdentity(parentPath, stagedDirectory.identity);
+    return {
+        fd,
+        guard: { dir: parentPath, realPath: parentPath, stat },
+        stagedDirectory,
+        observation: checkedMutationDirectory(parentPath, stagedDirectory.realPath, stat),
+    };
+}
+function tryDescribePolicyPosixParent(binding, fd, pathname) {
+    try {
+        const policyDirectory = describePolicyStagedDirectory(fd, pathname, binding);
+        return {
+            fd,
+            guard: {
+                dir: policyDirectory.directory.realPath,
+                realPath: policyDirectory.directory.realPath,
+                stat: policyDirectory.stat,
+            },
+            stagedDirectory: policyDirectory.directory,
+            observation: policyDirectory.observation,
+            policyDirectory,
+        };
+    }
+    catch (error) {
+        if (!(error instanceof FsSafeError) || error instanceof NativePolicyDirectoryMismatch ||
+            (error.code !== "path-mismatch" && error.code !== "not-file"))
+            throw error;
+        return undefined;
+    }
+}
+export async function capturePolicyAwareNativeParent(binding, params, rootAdmission, windows, directoryFlags, fuseChildCreation = false) {
+    const env_1 = { stack: [], error: void 0, hasError: false };
+    try {
+        const rootFd = rootAdmission.root.fd;
+        const closeFd = captureNativeFdClose(binding);
+        const observationDisposers = windows ? undefined : new Map();
+        const disposeObservation = (fd) => {
+            const dispose = observationDisposers?.get(fd);
+            observationDisposers?.delete(fd);
+            dispose?.();
+        };
+        const observationScope = __addDisposableResource(env_1, {
+            [Symbol.dispose]() { for (const dispose of observationDisposers?.values() ?? [])
+                dispose(); },
+        }, false);
+        const capturePolicyParent = (fd, pathname) => {
+            const captured = tryDescribePolicyPosixParent(binding, fd, pathname);
+            const dispose = captured?.policyDirectory?.disposeObservation;
+            if (dispose)
+                observationDisposers.set(fd, dispose);
+            return captured;
+        };
+        const assertCurrent = (parent) => windows
+            ? assertWindowsPolicyParentCurrent(parent)
+            : parent.policyDirectory
+                ? assertPolicyStagedDirectoryCurrent(parent.policyDirectory)
+                : assertStagedDirectoryCurrent(parent.stagedDirectory);
+        const closeAfterFailure = (fd, failure) => {
+            disposeObservation(fd);
+            if (windows)
+                closeWindowsPolicyParentAfterFailure(closeFd, fd, failure, rootAdmission.reportCloseErrors);
+            else
+                closeFd(fd);
+        };
+        let session;
+        async function authorize(request) {
+            const frozen = Object.freeze(request);
+            return await (session ? session.authorize(frozen) : windows
+                ? params.mutationAdmission.authorize(frozen)
+                : params.mutationAdmission?.authorize(frozen));
+        }
+        // POSIX begins its retained observation before the complete-parent open;
+        // Windows starts a walk session only after that fast path misses.
+        let segments = windows ? undefined : params.relativeParentPath.split("/").filter(Boolean);
+        let route = segments && createPathSegmentRoute(segments);
+        let initialTarget = route && joinPathSegmentRoute(params.rootPath, route, 0, params.basename);
+        const parentSpelling = segments?.length ? path.join(params.rootPath, ...segments) : params.rootPath;
+        let retainedTargetPath = windows ? undefined : params.mutationAdmission?.beginParentWalk?.();
+        if (retainedTargetPath && !sameAbsolutePath(retainedTargetPath, initialTarget)) {
+            retainedTargetPath = undefined;
+        }
+        let complete;
+        let completeFd;
+        try {
+            if (windows) {
+                complete = await openWindowsPolicyParent(binding, params, rootAdmission, rootFd, params.rootPath, params.relativeParentPath);
+                completeFd = complete.fd;
+            }
+            else {
+                completeFd = binding.openBeneath(rootFd, params.relativeParentPath, directoryFlags).fd;
+            }
+        }
+        catch (error) {
+            if (error?.code !== "ENOENT" || !params.mkdir) {
+                if (windows)
+                    throw error;
+                await authorize({ targetPath: initialTarget, mutationPath: initialTarget, phase: "parent" });
+                throw normalizePosixParentOpenError(error, params);
+            }
+        }
+        if (completeFd !== undefined) {
+            try {
+                complete ??= retainedTargetPath ? capturePolicyParent(completeFd, parentSpelling) : undefined;
+                if (!complete) {
+                    retainedTargetPath = undefined;
+                    complete = await describePosixParent(completeFd, parentSpelling);
+                }
+                const targetPath = path.join(complete.guard.realPath, params.basename);
+                await authorize({ targetPath, mutationPath: targetPath, phase: "parent" });
+                assertCurrent(complete);
+                return complete;
+            }
+            catch (error) {
+                closeAfterFailure(completeFd, { error });
+                throw error;
+            }
+        }
+        segments ??= params.relativeParentPath.split("/").filter(Boolean);
+        route ??= createPathSegmentRoute(segments);
+        let current;
+        if (windows) {
+            const rootStat = inspectDirectoryIdentitySync(params.rootPath, inspectFileIdentitySync(() => fsSync.fstatSync(rootFd, { bigint: true })));
+            const guard = { dir: params.rootPath, realPath: params.rootPath, stat: rootStat };
+            current = { fd: rootFd, guard, observation: windowsParentObservation(binding, rootFd, guard) };
+        }
+        else {
+            const captured = retainedTargetPath ? capturePolicyParent(rootFd, params.rootPath) : undefined;
+            if (!captured)
+                retainedTargetPath = undefined;
+            current = captured ?? await describePosixParent(rootFd, params.rootPath);
+        }
+        let ownedFd;
+        let currentPath = params.rootPath;
+        let failure;
+        initialTarget ??= joinPathSegmentRoute(params.rootPath, route, 0, params.basename);
+        if (windows && canReuseParentWithMutationAssertion(params.assertBeforeMutation, params.rootPath, initialTarget)) {
+            session = params.mutationAdmission?.beginNativeParentWalk?.() ?? params.mutationAdmission?.beginSharedParentWalk?.();
+            if (session && session.retainedTargetPath !== initialTarget) {
+                session.dispose();
+                session = undefined;
+            }
+        }
+        const secureDirectoryFlags = directoryFlags | (fsSync.constants.O_NOFOLLOW ?? 0);
+        try {
+            if (!windows) {
+                const targetPath = retainedTargetPath ?? initialTarget;
+                await authorize({ targetPath, mutationPath: targetPath, phase: "parent" });
+                assertCurrent(current);
+            }
+            for (let index = 0; index < segments.length; index += 1) {
+                const segment = segments[index];
+                let childPath = windows ? undefined : path.join(currentPath, segment);
+                let child;
+                let childFd;
+                let createdByMkdir = false;
+                let createReceipt;
+                try {
+                    if (windows) {
+                        child = await openWindowsPolicyParent(binding, params, rootAdmission, current.fd, currentPath, segment);
+                        childFd = child.fd;
+                    }
+                    else {
+                        childFd = binding.openBeneath(current.fd, segment, secureDirectoryFlags).fd;
+                    }
+                }
+                catch (error) {
+                    const missing = windows
+                        ? error?.code === "ENOENT"
+                        : isNotFoundPathError(error);
+                    if (!missing)
+                        throw windows ? error : normalizePosixParentOpenError(error, params);
+                    const targetPath = (windows ? session?.retainedTargetPath : retainedTargetPath) ??
+                        joinPathSegmentRoute(currentPath, route, index, params.basename);
+                    childPath ??= path.join(currentPath, segment);
+                    const request = Object.freeze({
+                        targetPath, mutationPath: childPath, phase: "parent-create",
+                    });
+                    createReceipt = windows
+                        ? session?.tryAuthorizeAtParent(request, current.observation)
+                        : params.mutationAdmission?.tryAuthorizeAtParent?.(request, current.observation);
+                    if (!createReceipt) {
+                        createReceipt = await authorize(windows ? { ...request } : request);
+                        assertCurrent(current);
+                    }
+                    // POSIX always refreshes here; Windows refreshes only after a live callback.
+                    if (windows) {
+                        if (params.assertBeforeMutation) {
+                            params.assertBeforeMutation();
+                            assertCurrent(current);
+                        }
+                    }
+                    else {
+                        params.assertBeforeMutation?.();
+                        assertCurrent(current);
+                    }
+                    if (windows) {
+                        const mkdirChild = binding.mkdirChildBeneath;
+                        if (typeof mkdirChild !== "function") {
+                            throw new FsSafeError("helper-unavailable", "native direct-child parent creation is unavailable");
+                        }
+                        createdByMkdir = mkdirChild.call(binding, current.fd, segment, 0o777) === true;
+                        child = await openWindowsPolicyParent(binding, params, rootAdmission, current.fd, currentPath, segment);
+                        childFd = child.fd;
+                    }
+                    else {
+                        if (fuseChildCreation && binding.mkdirOpenChildBeneath) {
+                            try {
+                                const child = binding.mkdirOpenChildBeneath(current.fd, segment, 0o777, secureDirectoryFlags);
+                                childFd = child.fd;
+                                createdByMkdir = child.created;
+                            }
+                            catch (error) {
+                                throw normalizePosixParentOpenError(error, params);
+                            }
+                        }
+                        else {
+                            createdByMkdir = mkdirPosixPolicyChild(binding, current.fd, segment);
+                            try {
+                                childFd = binding.openBeneath(current.fd, segment, secureDirectoryFlags).fd;
+                            }
+                            catch (error) {
+                                throw normalizePosixParentOpenError(error, params);
+                            }
+                        }
+                    }
+                }
+                try {
+                    if (!child) {
+                        child = retainedTargetPath ? capturePolicyParent(childFd, childPath) : undefined;
+                        if (!child) {
+                            retainedTargetPath = undefined;
+                            child = await describePosixParent(childFd, childPath);
+                        }
+                        if (!sameAbsolutePath(child.guard.realPath, childPath))
+                            retainedTargetPath = undefined;
+                    }
+                    const windowsTarget = windows
+                        ? joinPathSegmentRoute(child.guard.realPath, route, index + 1, params.basename)
+                        : undefined;
+                    if (session && windowsTarget !== session.retainedTargetPath) {
+                        session.dispose();
+                        session = undefined;
+                    }
+                    let childAuthorization;
+                    if (createdByMkdir && createReceipt &&
+                        (windows ? session : params.mutationAdmission?.advanceCreatedDirectory)) {
+                        let evidence;
+                        try {
+                            const parent = windows
+                                ? windowsParentObservation(binding, current.fd, { ...current.guard,
+                                    stat: inspectFileIdentitySync(() => fsSync.fstatSync(current.fd, { bigint: true }), current.guard.stat),
+                                })
+                                : current.policyDirectory
+                                    ? refreshPolicyStagedDirectoryObservation(current.policyDirectory)
+                                    : checkedMutationDirectory(currentPath, current.stagedDirectory.realPath, assertStagedDirectoryCurrent(current.stagedDirectory));
+                            evidence = Object.freeze({
+                                admission: createReceipt,
+                                parent,
+                                child: child.observation,
+                            });
+                        }
+                        catch {
+                            // Failed optional evidence falls back to the existing ordered admission.
+                        }
+                        if (evidence) {
+                            childAuthorization = windows
+                                ? session.advanceCreatedDirectory(evidence)
+                                : params.mutationAdmission.advanceCreatedDirectory(evidence);
+                        }
+                    }
+                    const targetPath = windowsTarget ?? retainedTargetPath ??
+                        joinPathSegmentRoute(child.guard.realPath, route, index + 1, params.basename);
+                    if (!windows || !childAuthorization) {
+                        const request = {
+                            targetPath, mutationPath: targetPath, phase: "parent",
+                        };
+                        if (!windows) {
+                            Object.freeze(request);
+                            // Existing prefixes are not the epoch's nearest parent. Their
+                            // admission uses the full epoch fence below; offering an unrelated
+                            // parent receipt would discard otherwise-current target evidence.
+                            if (createdByMkdir) {
+                                childAuthorization ??= params.mutationAdmission?.tryAuthorizeAtParent?.(request, child.observation);
+                            }
+                        }
+                        if (!childAuthorization) {
+                            await authorize(request);
+                            assertCurrent(child);
+                        }
+                    }
+                }
+                catch (error) {
+                    closeAfterFailure(childFd, { error });
+                    throw error;
+                }
+                const previousFd = ownedFd;
+                disposeObservation(current.fd);
+                current = child;
+                ownedFd = child.fd;
+                currentPath = child.guard.realPath;
+                if (previousFd !== undefined)
+                    closeFd(previousFd);
+            }
+            if (ownedFd === undefined) {
+                throw new FsSafeError("path-mismatch", "native write parent admission did not complete");
+            }
+            ownedFd = undefined;
+            return current;
+        }
+        catch (error) {
+            failure = { error };
+            throw error;
+        }
+        finally {
+            session?.dispose();
+            if (ownedFd !== undefined)
+                closeAfterFailure(ownedFd, failure);
+        }
+    }
+    catch (e_1) {
+        env_1.error = e_1;
+        env_1.hasError = true;
+    }
+    finally {
+        __disposeResources(env_1);
+    }
+}