@openclaw/fs-safe 0.13.1 → 0.14.0

package/CHANGELOG.md

@@ -1,6 +1,19 @@
 # Changelog
 
-## Unreleased
+## 0.14.0 - 2026-09-17
+
+### Highlights
+
+- **Safer guest directory selection:** descriptor-relative listings now report regular files as well as directories without following symlinks, so consumers can select files without reopening path-type checks.
+
+### Filesystem boundaries and performance
+
+- Report both directory and regular-file kinds from descriptor-relative guest listings. Symlinks and special entries report neither kind.
+- Reduce repeated filesystem observations during policy-bound native parent creation, Windows compatibility writes and metadata reads, synchronous store-directory permission repair, and missing temporary-root creation. Fresh identity, canonical-path, lock-destination, callback, and publication checks remain at mutation boundaries.
+
+### Validation
+
+- Register the path-prefix and synchronous `lockRoot` performance workflows on the default branch. Their dispatch stubs fail closed without checking out or executing repository code.
 
 ## 0.13.1 - 2026-09-16
 

package/dist/file-store-sync-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-store-sync-directory.d.ts","sourceRoot":"","sources":["../src/file-store-sync-directory.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAc/C,KAAK,kBAAkB,GAAG,eAAe,GAAG,OAAO,CAAC;AAOpD,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;CACxB,CAAC,CAAC;AAkVH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,kBAAkB,CAAC;CACnC,GAAG,yBAAyB,CA4D5B;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,yBAAyB,GACjC,IAAI,CAsBN"}
+{"version":3,"file":"file-store-sync-directory.d.ts","sourceRoot":"","sources":["../src/file-store-sync-directory.ts"],"names":[],"mappings":"AAAA,OAAW,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAc/C,KAAK,kBAAkB,GAAG,eAAe,GAAG,OAAO,CAAC;AAOpD,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;CACxB,CAAC,CAAC;AA0VH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,kBAAkB,CAAC;CACnC,GAAG,yBAAyB,CA4D5B;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,yBAAyB,GACjC,IAAI,CAsBN"}

package/dist/file-store-sync-directory.js

@@ -11,7 +11,9 @@ function changedStoreDirectory(messagePrefix, cause) {
     return new FsSafeError("outside-workspace", `${messagePrefix} directory escapes root`, { cause });
 }
 function storeDirectoryRealPath(dir) {
-    const realPath = realpathSync(pathForWindowsFilesystem(dir));
+    const operationPath = pathForWindowsFilesystem(dir);
+    const realPath = process.platform === "win32"
+        ? realpathSync(operationPath) : realpathSync.native(operationPath);
     assertNoWindowsPathAlias(realPath, "filesystem");
     return realPath;
 }
@@ -72,7 +74,9 @@ function assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix) {
     if (!rootReceipt || !targetReceipt) {
         throw new FsSafeError("helper-failed", "store directory receipt is missing");
     }
-    const rootStat = assertRootCurrent(rootReceipt, rootReal, messagePrefix);
+    const rootStat = rootReal === undefined
+        ? inspectReceiptCurrent(rootReceipt, messagePrefix, true)
+        : assertRootCurrent(rootReceipt, rootReal, messagePrefix);
     if (targetIndex === 0)
         return rootStat;
     const parent = receipts[targetIndex - 1];
@@ -87,10 +91,13 @@ function assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix) {
     return targetStat;
 }
 function assertModeTargetCurrent(receipts, rootReal, messagePrefix) {
+    const root = receipts[0];
     const target = receipts.at(-1);
-    if (!target)
+    if (!root || !target)
         throw new FsSafeError("helper-failed", "store directory receipt is missing");
-    const stat = assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix);
+    // The target's canonical observation shares the exact identity fence. Keep
+    // the trailing root canonical check: an ancestor relocation can retain IDs.
+    assertAdmittedEdgeCurrent(receipts, undefined, messagePrefix);
     let targetReal;
     try {
         targetReal = storeDirectoryRealPath(target.dir);
@@ -98,10 +105,10 @@ function assertModeTargetCurrent(receipts, rootReal, messagePrefix) {
     catch (error) {
         throw changedStoreDirectory(messagePrefix, error);
     }
-    if (!isPathInside(rootReal, targetReal))
+    if (target === root ? targetReal !== rootReal : !isPathInside(rootReal, targetReal)) {
         throw changedStoreDirectory(messagePrefix);
-    assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix);
-    return stat;
+    }
+    return assertAdmittedEdgeCurrent(receipts, rootReal, messagePrefix);
 }
 function assertReceiptChain(receipts, rootReal, messagePrefix) {
     const rootReceipt = receipts[0];

package/dist/guest-dispatch-python.js

@@ -59,7 +59,7 @@ export const GUEST_FILESYSTEM_DISPATCH_PYTHON = [
     "    try:",
     "        target_fd = walk_dir(root_fd, sys.argv[3], False)",
     "        with os.scandir(target_fd) as entries:",
-    "            print(json.dumps([{'name': entry.name, 'isDirectory': entry.is_dir(follow_symlinks=False)} for entry in entries]))",
+    "            print(json.dumps([{'name': entry.name, 'isDirectory': entry.is_dir(follow_symlinks=False), 'isFile': entry.is_file(follow_symlinks=False)} for entry in entries]))",
     "    finally:",
     "        if target_fd is not None:",
     "            os.close(target_fd)",

package/dist/native-binding.d.ts

@@ -20,6 +20,10 @@ export interface NativeDirectoryObservation {
     ino: bigint;
     realPath: string;
 }
+export interface NativeDirectoryFdObservation extends NativeDirectoryObservation {
+    mode: bigint;
+    nlink: bigint;
+}
 export interface NativeArchiveEntry {
     index: number;
     path: string;
@@ -100,6 +104,8 @@ export interface NativeBinding {
     };
     /** Internal: exact directory identity and canonical path from one no-follow handle. */
     observeDirectory?(path: string): NativeDirectoryObservation;
+    /** Internal POSIX-only exact name/descriptor observation; the caller retains its fd. */
+    observeDirectoryFd?(fd: number, expectedPath: string): NativeDirectoryFdObservation;
     /** Linux/Windows byte transfer; callers retain both admitted descriptors until settlement. */
     copyFileContents?(sourceFd: number, targetFd: number, signal?: AbortSignal): Promise<void>;
     /** Internal: same private, immutable input ownership as the ZIP buffer reader. */

package/dist/native-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-binding.d.ts","sourceRoot":"","sources":["../src/native-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;CAAG;AAErE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,iBAAiB,GAAG,MAAM,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,eAAe,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,+BAA+B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,oCAAoC;IACnD,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,0BAA0B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,CAAC;IACpD,wFAAwF;IACxF,gBAAgB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,uFAAuF;IACvF,gBAAgB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC5D,8FAA8F;IAC9F,gBAAgB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,kFAAkF;IAClF,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QACvG,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACvC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACnF,CAAC,CAAC;IACH,4FAA4F;IAC5F,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QACzF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACvC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACnF,CAAC,CAAC;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACnF,SAAS,CACP,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,gBAAgB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAChF,gBAAgB,CAAC,CACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC;IAC3C,iBAAiB,CAAC,CAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1F,sBAAsB,CACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,sBAAsB,EAAE,EAC9B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAC9C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,oFAAoF;IACpF,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAAC;IACrF,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC3D,8EAA8E;IAC9E,8BAA8B,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,oCAAoC,CAAC;IAClF,yBAAyB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,eAAe,CAAC,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzC,mBAAmB,CAAC,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,4BAA4B,CAAC;IAChC,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1F;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,aAAa,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAMjF"}
+{"version":3,"file":"native-binding.d.ts","sourceRoot":"","sources":["../src/native-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,4BAA6B,SAAQ,0BAA0B;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAuB,SAAQ,kBAAkB;CAAG;AAErE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,iBAAiB,GAAG,MAAM,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,eAAe,GAAG,aAAa,CAAC;CAC9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,OAAO,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,EAAE,+BAA+B,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,oCAAoC;IACnD,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,0BAA0B,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,8EAA8E;IAC9E,gBAAgB,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,oBAAoB,CAAC;IACpD,wFAAwF;IACxF,gBAAgB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,uFAAuF;IACvF,gBAAgB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC5D,wFAAwF;IACxF,kBAAkB,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,4BAA4B,CAAC;IACpF,8FAA8F;IAC9F,gBAAgB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3F,kFAAkF;IAClF,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QACvG,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACvC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACnF,CAAC,CAAC;IACH,4FAA4F;IAC5F,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QACzF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACvC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KACnF,CAAC,CAAC;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IACnF,SAAS,CACP,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB,gBAAgB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9D,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAChF,gBAAgB,CAAC,CACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,SAAS,GAAG,aAAa,GAAG,WAAW,CAAC;IAC3C,iBAAiB,CAAC,CAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1F,sBAAsB,CACpB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,sBAAsB,EAAE,EAC9B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAC9C,oBAAoB,CAClB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,WAAW,CACT,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,oFAAoF;IACpF,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,uBAAuB,CAAC;IACrF,sBAAsB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,0BAA0B,CAAC;IAC3D,8EAA8E;IAC9E,8BAA8B,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,oCAAoC,CAAC;IAClF,yBAAyB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACtD,eAAe,CAAC,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACzC,mBAAmB,CAAC,CAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,4BAA4B,CAAC;IAChC,eAAe,CACb,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,aAAa,CACX,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CAAC;IACR,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1F;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,aAAa,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAMjF"}

package/dist/native-pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,KAAK,EAIV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAqV3B,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsGvH"}
+{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAIV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AA8W3B,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsGvH"}

package/dist/native-pinned-write.js

@@ -58,6 +58,7 @@ import { runPinnedWriteWindows } from "./native-pinned-write-windows.js";
 import { openNativeParentAdmission, openNativeRootAdmission } from "./native-parent-admission.js";
 import { assertNativeStaging, writeNativeStage } from "./native-staged-file.js";
 import { captureNativeFdClose } from "./native-binding.js";
+import { NativePolicyDirectoryMismatch } from "./native-policy-directory-observation.js";
 import { assertPolicyStagedDirectoryCurrent, assertStagedDirectoryCurrent, describePolicyStagedDirectory, describeStagedDirectory, refreshPolicyStagedDirectoryObservation, } from "./staged-directory.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { realpathSync } from "./realpath.js";
@@ -118,8 +119,8 @@ async function describePosixParent(parentFd, pathname) {
         observation: checkedMutationDirectory(parentPath, directory.realPath, parentPathStat),
     };
 }
-function describePolicyPosixParent(parentFd, pathname) {
-    const policyDirectory = describePolicyStagedDirectory(parentFd, pathname);
+function describePolicyPosixParent(binding, parentFd, pathname) {
+    const policyDirectory = describePolicyStagedDirectory(parentFd, pathname, binding);
     return {
         parentFd,
         parentPath: policyDirectory.directory.realPath,
@@ -131,11 +132,12 @@ function describePolicyPosixParent(parentFd, pathname) {
 }
 function policyParentCaptureDeopt(error) {
     return error instanceof FsSafeError &&
+        !(error instanceof NativePolicyDirectoryMismatch) &&
         (error.code === "path-mismatch" || error.code === "not-file");
 }
-function tryDescribePolicyPosixParent(parentFd, pathname) {
+function tryDescribePolicyPosixParent(binding, parentFd, pathname) {
     try {
-        return describePolicyPosixParent(parentFd, pathname);
+        return describePolicyPosixParent(binding, parentFd, pathname);
     }
     catch (error) {
         if (!policyParentCaptureDeopt(error))
@@ -149,183 +151,215 @@ function assertPosixParentCurrent(parent) {
         : assertStagedDirectoryCurrent(parent.directory);
 }
 async function capturePolicyAwarePosixParent(binding, params, rootFd, directoryFlags) {
-    const closeFd = captureNativeFdClose(binding);
-    const segments = relativeParentSegments(params.relativeParentPath);
-    const parentSpelling = segments.length
-        ? path.join(params.rootPath, ...segments)
-        : params.rootPath;
-    const segmentRoute = createPathSegmentRoute(segments);
-    const initialTarget = prospectiveTargetPath(params.rootPath, segmentRoute, 0, params.basename);
-    let retainedTargetPath = params.mutationAdmission?.beginParentWalk?.();
-    if (retainedTargetPath && !sameAbsolutePath(retainedTargetPath, initialTarget)) {
-        retainedTargetPath = undefined;
-    }
-    // Preserve the one-open hot path when the complete parent still exists.
-    // Policy is attached only after the opened descriptor is associated with its
-    // current canonical pathname, so a contained redirect cannot retain the old
-    // preflight authorization.
-    let completeParentFd;
+    const env_1 = { stack: [], error: void 0, hasError: false };
     try {
-        completeParentFd = binding.openBeneath(rootFd, params.relativeParentPath, directoryFlags).fd;
-    }
-    catch (error) {
-        if (error?.code !== "ENOENT" || !params.mkdir)
-            throw error;
-    }
-    if (completeParentFd !== undefined) {
-        const parentFd = completeParentFd;
+        const closeFd = captureNativeFdClose(binding);
+        const observationDisposers = new Map();
+        const disposeObservation = (fd) => {
+            const dispose = observationDisposers.get(fd);
+            observationDisposers.delete(fd);
+            dispose?.();
+        };
+        const observationScope = __addDisposableResource(env_1, {
+            [Symbol.dispose]() { for (const dispose of observationDisposers.values())
+                dispose(); },
+        }, false);
+        const capturePolicyParent = (fd, pathname) => {
+            const captured = tryDescribePolicyPosixParent(binding, fd, pathname);
+            const dispose = captured?.policyDirectory?.disposeObservation;
+            if (dispose)
+                observationDisposers.set(fd, dispose);
+            return captured;
+        };
+        const segments = relativeParentSegments(params.relativeParentPath);
+        const parentSpelling = segments.length
+            ? path.join(params.rootPath, ...segments)
+            : params.rootPath;
+        const segmentRoute = createPathSegmentRoute(segments);
+        const initialTarget = prospectiveTargetPath(params.rootPath, segmentRoute, 0, params.basename);
+        let retainedTargetPath = params.mutationAdmission?.beginParentWalk?.();
+        if (retainedTargetPath && !sameAbsolutePath(retainedTargetPath, initialTarget)) {
+            retainedTargetPath = undefined;
+        }
+        // Preserve the one-open hot path when the complete parent still exists.
+        // Policy is attached only after the opened descriptor is associated with its
+        // current canonical pathname, so a contained redirect cannot retain the old
+        // preflight authorization.
+        let completeParentFd;
         try {
-            let admitted = retainedTargetPath
-                ? tryDescribePolicyPosixParent(parentFd, parentSpelling)
-                : undefined;
-            if (!admitted) {
-                retainedTargetPath = undefined;
-                admitted = await describePosixParent(parentFd, parentSpelling);
-            }
-            const targetPath = path.join(admitted.parentPath, params.basename);
-            await authorizePinnedMutation(params, {
-                targetPath,
-                mutationPath: targetPath,
-                phase: "parent",
-            });
-            assertPosixParentCurrent(admitted);
-            return admitted;
+            completeParentFd = binding.openBeneath(rootFd, params.relativeParentPath, directoryFlags).fd;
         }
         catch (error) {
-            closeFd(parentFd);
-            throw error;
+            if (error?.code !== "ENOENT" || !params.mkdir)
+                throw error;
         }
-    }
-    // The canonical preflight spelling has no intentional symlinks in its
-    // existing prefix. Walk missing-parent cases one direct child at a time so
-    // every existing/opened object is authorized and every mkdir is authorized
-    // before dispatch. O_NOFOLLOW makes a concurrently introduced link fail
-    // before the next component can be created through it.
-    const secureDirectoryFlags = directoryFlags | (fsSync.constants.O_NOFOLLOW ?? 0);
-    let currentFd = rootFd;
-    let currentOwnedFd;
-    let currentPath = params.rootPath;
-    let current = retainedTargetPath
-        ? tryDescribePolicyPosixParent(rootFd, currentPath)
-        : undefined;
-    if (!current) {
-        retainedTargetPath = undefined;
-        current = await describePosixParent(rootFd, currentPath);
-    }
-    try {
-        await authorizePinnedMutation(params, {
-            targetPath: retainedTargetPath ?? initialTarget,
-            mutationPath: retainedTargetPath ?? initialTarget,
-            phase: "parent",
-        });
-        assertPosixParentCurrent(current);
-        for (let index = 0; index < segments.length; index += 1) {
-            const segment = segments[index];
-            const childPath = path.join(currentPath, segment);
-            let childFd;
-            let createdByMkdir = false;
-            let createReceipt;
+        if (completeParentFd !== undefined) {
+            const parentFd = completeParentFd;
             try {
-                childFd = binding.openBeneath(currentFd, segment, secureDirectoryFlags).fd;
-            }
-            catch (openError) {
-                if (!isNotFoundPathError(openError)) {
-                    throw normalizePolicyParentOpenError(openError, params);
+                let admitted = retainedTargetPath
+                    ? capturePolicyParent(parentFd, parentSpelling)
+                    : undefined;
+                if (!admitted) {
+                    retainedTargetPath = undefined;
+                    admitted = await describePosixParent(parentFd, parentSpelling);
                 }
-                const targetPath = retainedTargetPath ?? prospectiveTargetPath(currentPath, segmentRoute, index, params.basename);
-                const request = Object.freeze({
+                const targetPath = path.join(admitted.parentPath, params.basename);
+                await authorizePinnedMutation(params, {
                     targetPath,
-                    mutationPath: childPath,
-                    phase: "parent-create",
+                    mutationPath: targetPath,
+                    phase: "parent",
                 });
-                createReceipt = params.mutationAdmission?.tryAuthorizeAtParent?.(request, current.observation);
-                if (!createReceipt) {
-                    createReceipt = await authorizePinnedMutation(params, request);
-                    assertPosixParentCurrent(current);
-                }
-                params.assertBeforeMutation?.();
-                // Do not carry pathname freshness across the live authority callback.
-                assertPosixParentCurrent(current);
-                createdByMkdir = mkdirPolicyChild(binding, currentFd, segment, 0o777);
+                assertPosixParentCurrent(admitted);
+                return admitted;
+            }
+            catch (error) {
+                disposeObservation(parentFd);
+                closeFd(parentFd);
+                throw error;
+            }
+        }
+        // The canonical preflight spelling has no intentional symlinks in its
+        // existing prefix. Walk missing-parent cases one direct child at a time so
+        // every existing/opened object is authorized and every mkdir is authorized
+        // before dispatch. O_NOFOLLOW makes a concurrently introduced link fail
+        // before the next component can be created through it.
+        const secureDirectoryFlags = directoryFlags | (fsSync.constants.O_NOFOLLOW ?? 0);
+        let currentFd = rootFd;
+        let currentOwnedFd;
+        let currentPath = params.rootPath;
+        let current = retainedTargetPath
+            ? capturePolicyParent(rootFd, currentPath)
+            : undefined;
+        if (!current) {
+            retainedTargetPath = undefined;
+            current = await describePosixParent(rootFd, currentPath);
+        }
+        try {
+            await authorizePinnedMutation(params, {
+                targetPath: retainedTargetPath ?? initialTarget,
+                mutationPath: retainedTargetPath ?? initialTarget,
+                phase: "parent",
+            });
+            assertPosixParentCurrent(current);
+            for (let index = 0; index < segments.length; index += 1) {
+                const segment = segments[index];
+                const childPath = path.join(currentPath, segment);
+                let childFd;
+                let createdByMkdir = false;
+                let createReceipt;
                 try {
                     childFd = binding.openBeneath(currentFd, segment, secureDirectoryFlags).fd;
                 }
-                catch (createdOpenError) {
-                    throw normalizePolicyParentOpenError(createdOpenError, params);
-                }
-            }
-            let child;
-            try {
-                const acceleratedChild = retainedTargetPath
-                    ? tryDescribePolicyPosixParent(childFd, childPath)
-                    : undefined;
-                if (acceleratedChild) {
-                    child = acceleratedChild;
-                }
-                else {
-                    retainedTargetPath = undefined;
-                    child = await describePosixParent(childFd, childPath);
-                }
-                if (!sameAbsolutePath(child.parentPath, childPath))
-                    retainedTargetPath = undefined;
-                let childAuthorization;
-                if (createdByMkdir && createReceipt && params.mutationAdmission?.advanceCreatedDirectory) {
-                    let evidence;
+                catch (openError) {
+                    if (!isNotFoundPathError(openError)) {
+                        throw normalizePolicyParentOpenError(openError, params);
+                    }
+                    const targetPath = retainedTargetPath ?? prospectiveTargetPath(currentPath, segmentRoute, index, params.basename);
+                    const request = Object.freeze({
+                        targetPath,
+                        mutationPath: childPath,
+                        phase: "parent-create",
+                    });
+                    createReceipt = params.mutationAdmission?.tryAuthorizeAtParent?.(request, current.observation);
+                    if (!createReceipt) {
+                        createReceipt = await authorizePinnedMutation(params, request);
+                        assertPosixParentCurrent(current);
+                    }
+                    params.assertBeforeMutation?.();
+                    // Do not carry pathname freshness across the live authority callback.
+                    assertPosixParentCurrent(current);
+                    createdByMkdir = mkdirPolicyChild(binding, currentFd, segment, 0o777);
                     try {
-                        const parent = current.policyDirectory
-                            ? refreshPolicyStagedDirectoryObservation(current.policyDirectory)
-                            : checkedMutationDirectory(currentPath, current.directory.realPath, assertStagedDirectoryCurrent(current.directory));
-                        evidence = Object.freeze({
-                            admission: createReceipt,
-                            parent,
-                            child: child.observation,
-                        });
+                        childFd = binding.openBeneath(currentFd, segment, secureDirectoryFlags).fd;
                     }
-                    catch {
-                        // Leave failed evidence to the full ordered admission below.
+                    catch (createdOpenError) {
+                        throw normalizePolicyParentOpenError(createdOpenError, params);
                     }
-                    if (evidence) {
-                        childAuthorization = params.mutationAdmission.advanceCreatedDirectory(evidence);
+                }
+                let child;
+                try {
+                    const acceleratedChild = retainedTargetPath
+                        ? capturePolicyParent(childFd, childPath)
+                        : undefined;
+                    if (acceleratedChild) {
+                        child = acceleratedChild;
+                    }
+                    else {
+                        retainedTargetPath = undefined;
+                        child = await describePosixParent(childFd, childPath);
+                    }
+                    if (!sameAbsolutePath(child.parentPath, childPath))
+                        retainedTargetPath = undefined;
+                    let childAuthorization;
+                    if (createdByMkdir && createReceipt && params.mutationAdmission?.advanceCreatedDirectory) {
+                        let evidence;
+                        try {
+                            const parent = current.policyDirectory
+                                ? refreshPolicyStagedDirectoryObservation(current.policyDirectory)
+                                : checkedMutationDirectory(currentPath, current.directory.realPath, assertStagedDirectoryCurrent(current.directory));
+                            evidence = Object.freeze({
+                                admission: createReceipt,
+                                parent,
+                                child: child.observation,
+                            });
+                        }
+                        catch {
+                            // Leave failed evidence to the full ordered admission below.
+                        }
+                        if (evidence) {
+                            childAuthorization = params.mutationAdmission.advanceCreatedDirectory(evidence);
+                        }
+                    }
+                    const targetPath = retainedTargetPath ?? prospectiveTargetPath(child.parentPath, segmentRoute, index + 1, params.basename);
+                    const request = Object.freeze({
+                        targetPath,
+                        mutationPath: targetPath,
+                        phase: "parent",
+                    });
+                    childAuthorization ??= params.mutationAdmission?.tryAuthorizeAtParent?.(request, child.observation);
+                    if (!childAuthorization) {
+                        await authorizePinnedMutation(params, request);
+                        assertPosixParentCurrent(child);
                     }
                 }
-                const targetPath = retainedTargetPath ?? prospectiveTargetPath(child.parentPath, segmentRoute, index + 1, params.basename);
-                const request = Object.freeze({
-                    targetPath,
-                    mutationPath: targetPath,
-                    phase: "parent",
-                });
-                childAuthorization ??= params.mutationAdmission?.tryAuthorizeAtParent?.(request, child.observation);
-                if (!childAuthorization) {
-                    await authorizePinnedMutation(params, request);
-                    assertPosixParentCurrent(child);
+                catch (error) {
+                    disposeObservation(childFd);
+                    closeFd(childFd);
+                    throw error;
+                }
+                const previousOwnedFd = currentOwnedFd;
+                disposeObservation(current.parentFd);
+                currentOwnedFd = child.parentFd;
+                currentFd = child.parentFd;
+                currentPath = child.parentPath;
+                current = child;
+                if (previousOwnedFd !== undefined)
+                    closeFd(previousOwnedFd);
+                if (index === segments.length - 1) {
+                    currentOwnedFd = undefined;
+                    return child;
                 }
             }
-            catch (error) {
-                closeFd(childFd);
-                throw error;
-            }
-            const previousOwnedFd = currentOwnedFd;
-            currentOwnedFd = child.parentFd;
-            currentFd = child.parentFd;
-            currentPath = child.parentPath;
-            current = child;
-            if (previousOwnedFd !== undefined)
-                closeFd(previousOwnedFd);
-            if (index === segments.length - 1) {
-                currentOwnedFd = undefined;
-                return child;
+            // Empty relative parents are handled by the complete-parent fast path.
+            throw new FsSafeError("path-mismatch", "native write parent admission did not complete");
+        }
+        finally {
+            if (currentOwnedFd !== undefined) {
+                disposeObservation(currentOwnedFd);
+                closeFd(currentOwnedFd);
             }
         }
-        // Empty relative parents are handled by the complete-parent fast path.
-        throw new FsSafeError("path-mismatch", "native write parent admission did not complete");
+    }
+    catch (e_1) {
+        env_1.error = e_1;
+        env_1.hasError = true;
     }
     finally {
-        if (currentOwnedFd !== undefined)
-            closeFd(currentOwnedFd);
+        __disposeResources(env_1);
     }
 }
 export async function runPinnedWriteNative(binding, params) {
-    const env_1 = { stack: [], error: void 0, hasError: false };
+    const env_2 = { stack: [], error: void 0, hasError: false };
     try {
         const closeFd = captureNativeFdClose(binding);
         const windows = process.platform === "win32";
@@ -339,12 +373,12 @@ export async function runPinnedWriteNative(binding, params) {
             operation: "native write",
         });
         const root = rootAdmission.root;
-        const posixRoot = __addDisposableResource(env_1, windows ? undefined : root, true);
+        const posixRoot = __addDisposableResource(env_2, windows ? undefined : root, true);
         let parentFd;
         let windowsOwnsDirectories = false;
         // Until stage construction takes ownership, even admission failures must close
         // the raw POSIX parent. Disposal preserves both admission and close failures.
-        const parentGuard = __addDisposableResource(env_1, {
+        const parentGuard = __addDisposableResource(env_2, {
             [Symbol.dispose]() {
                 if (!windows && parentFd !== undefined) {
                     closeFd(parentFd);
@@ -423,12 +457,12 @@ export async function runPinnedWriteNative(binding, params) {
             }
         }
     }
-    catch (e_1) {
-        env_1.error = e_1;
-        env_1.hasError = true;
+    catch (e_2) {
+        env_2.error = e_2;
+        env_2.hasError = true;
     }
     finally {
-        const result_1 = __disposeResources(env_1);
+        const result_1 = __disposeResources(env_2);
         if (result_1)
             await result_1;
     }

package/dist/native-policy-directory-observation.d.ts

@@ -0,0 +1,12 @@
+import { FsSafeError } from "./errors.js";
+import type { NativeBinding } from "./native-binding.js";
+import type { MutationDirectoryObserver } from "./pinned-mutation-observation.js";
+export declare class NativePolicyDirectoryMismatch extends FsSafeError {
+    constructor(cause?: Error);
+}
+export type NativePolicyDirectoryObserver = MutationDirectoryObserver & {
+    dispose(): void;
+};
+/** Fresh name/metadata/canonical facts from a caller-owned POSIX descriptor. */
+export declare function nativePolicyDirectoryObserver(binding: NativeBinding | undefined, fd: number, pathname: string): NativePolicyDirectoryObserver | undefined;
+//# sourceMappingURL=native-policy-directory-observation.d.ts.map

package/dist/native-policy-directory-observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-policy-directory-observation.d.ts","sourceRoot":"","sources":["../src/native-policy-directory-observation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAElF,qBAAa,6BAA8B,SAAQ,WAAW;IAC5D,YAAY,KAAK,CAAC,EAAE,KAAK,EAExB;CACF;AAED,MAAM,MAAM,6BAA6B,GAAG,yBAAyB,GAAG;IAAE,OAAO,IAAI,IAAI,CAAA;CAAE,CAAC;AAE5F,gFAAgF;AAChF,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GACf,6BAA6B,GAAG,SAAS,CA2C3C"}