@openclaw/fs-safe 0.14.0 → 0.16.0

package/dist/native-parent-admission.js

@@ -1,7 +1,8 @@
 import fsSync, {} from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { inspectDirectoryIdentity } from "./directory-guard.js";
+import { inspectDirectoryIdentity, inspectDirectoryIdentitySync } from "./directory-guard.js";
+import { inspectNativeDirectoryObservation } from "./native-directory-observation.js";
 import { FsSafeError } from "./errors.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { realpathSync } from "./realpath.js";
@@ -50,6 +51,7 @@ export async function openNativeRootAdmission(binding, params) {
         }
         return {
             exactRoot,
+            reportCloseErrors: params.reportCloseErrors,
             operation: params.operation ?? "native admission",
             root,
             rootPath: params.rootPath,
@@ -61,14 +63,14 @@ export async function openNativeRootAdmission(binding, params) {
         }
         catch (closeError) {
             // Windows admission keeps the typed boundary failure primary.
-            if (process.platform !== "win32") {
+            if (process.platform !== "win32" || params.reportCloseErrors) {
                 throw createSuppressedError(closeError, error, "native root admission and close failed");
             }
         }
         throw error;
     }
 }
-export async function openNativeParentAdmission(binding, rootAdmission, relativeParentPath) {
+export async function openNativeParentAdmission(binding, rootAdmission, relativeParentPath, observation) {
     assertParentAdmissionAvailable(binding);
     const closeFd = captureNativeFdClose(binding);
     const directoryFlags = fsSync.constants.O_RDONLY | (fsSync.constants.O_DIRECTORY ?? 0);
@@ -82,6 +84,27 @@ export async function openNativeParentAdmission(binding, rootAdmission, relative
         const parentInput = relativeParentPath
             ? path.join(rootAdmission.rootPath, ...relativeParentPath.split("/"))
             : rootAdmission.rootPath;
+        if (observation === "native-directory" && process.platform === "win32" && rootAdmission.exactRoot &&
+            typeof binding.observeDirectory === "function") {
+            const stat = inspectFileIdentitySync(() => fsSync.fstatSync(parentFd, { bigint: true }));
+            let observed;
+            try {
+                observed = inspectNativeDirectoryObservation(binding, parentInput, stat);
+            }
+            catch (error) {
+                if (error?.code !== "OBSERVATION_UNAVAILABLE")
+                    throw error;
+            }
+            if (observed) {
+                assertNoWindowsPathAlias(observed.realPath, "filesystem", "native parent uses a Windows filesystem namespace alias");
+                inspectDirectoryIdentitySync(observed.realPath, stat, stat);
+                return {
+                    fd: parentFd,
+                    close: () => closeFd(parentFd),
+                    guard: { dir: observed.realPath, realPath: observed.realPath, stat },
+                };
+            }
+        }
         const parentPath = realpathSync.native(pathForWindowsFilesystem(parentInput));
         assertNoWindowsPathAlias(parentPath, "filesystem", "native parent uses a Windows filesystem namespace alias");
         const stagedDirectory = process.platform === "win32"
@@ -115,13 +138,10 @@ export async function openNativeParentAdmission(binding, rootAdmission, relative
             closeFd(parentFd);
         }
         catch (closeError) {
-            if (process.platform !== "win32") {
+            if (process.platform !== "win32" || rootAdmission.reportCloseErrors) {
                 throw createSuppressedError(closeError, error, "native parent admission and close failed");
             }
         }
         throw error;
     }
 }
-export function closeNativeParentAdmission(admission) {
-    admission?.close();
-}

package/dist/native-pinned-write-windows.d.ts

@@ -1,5 +1,5 @@
 import type { FileHandle } from "node:fs/promises";
-import type { AnyAsyncDirectoryGuard } from "./directory-guard.js";
+import { type AnyAsyncDirectoryGuard } from "./directory-guard.js";
 import type { FileIdentityStat } from "./file-identity.js";
 import type { NativeBinding } from "./native.js";
 import type { PinnedWriteParams } from "./pinned-write.js";

package/dist/native-pinned-write-windows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-pinned-write-windows.d.ts","sourceRoot":"","sources":["../src/native-pinned-write-windows.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAa3D,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA2F3B"}
+{"version":3,"file":"native-pinned-write-windows.d.ts","sourceRoot":"","sources":["../src/native-pinned-write-windows.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAA4B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAM3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAuD3D,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,EACzB,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA6L3B"}

package/dist/native-pinned-write-windows.js

@@ -2,11 +2,20 @@ import { syncFileBestEffortSync } from "./file-sync.js";
 import { randomUUID } from "node:crypto";
 import fsSync, {} from "node:fs";
 import path from "node:path";
+import { createFileHandle } from "./create.js";
+import { hasPreservedCreationArtifacts } from "./creation-file-state.js";
+import { assertSyncDirectoryGuard } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
-import { nativeOpenFlags, removeNativeCreatedFileIfStillPinned, writeNativeInput, } from "./native-operations.js";
+import { nativeOpenFlags, removeNativeCreatedFileIfStillPinned, } from "./native-operations.js";
+import { writePinnedInput } from "./pinned-write-input.js";
 import { captureNativeFdClose } from "./native-binding.js";
 import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertFinalSymlinkRejected } from "./root-symlink-policy.js";
+import { classifyNativeRenameFailure } from "./native-rename-outcome.js";
+import { cleanupPinnedFilePath } from "./file-cleanup.js";
+import { createStagedFileReceipt, settleStagedFile } from "./staged-file-settlement.js";
+import { exactIdentityMatches } from "./staged-directory.js";
+import { inspectNativeDirectoryObservation } from "./native-directory-observation.js";
 function closeWriteFd(closeFd, fd) {
     if (fd === undefined)
         return;
@@ -14,42 +23,132 @@ function closeWriteFd(closeFd, fd) {
         closeFd(fd);
     }
     catch (error) {
-        return error;
+        return { error };
     }
 }
+function readParentIdentity(parentFd, guard) {
+    const stat = inspectFileIdentitySync(() => fsSync.fstatSync(parentFd, { bigint: true }));
+    if (!stat.isDirectory() || !exactIdentityMatches(guard.stat, stat)) {
+        throw new FsSafeError("path-mismatch", "native write parent identity changed");
+    }
+    return stat;
+}
+function assertNamedParentCurrent(binding, guard, identity) {
+    if (typeof binding.observeDirectory === "function") {
+        try {
+            const observed = inspectNativeDirectoryObservation(binding, guard.dir, identity);
+            if (observed.realPath !== guard.realPath) {
+                throw new FsSafeError("path-mismatch", "native write parent pathname changed");
+            }
+            return;
+        }
+        catch (error) {
+            if (error?.code !== "OBSERVATION_UNAVAILABLE")
+                throw error;
+        }
+    }
+    assertSyncDirectoryGuard({ ...guard, stat: identity });
+}
 export async function runPinnedWriteWindows(binding, params, root, parentFd, parentGuard) {
     const closeFd = captureNativeFdClose(binding);
     const parentPath = parentGuard.realPath;
     let tempFd;
+    let privateHandle;
     let targetFd;
+    let publicationProbeFd;
     let tempIdentity;
     let tempName = "";
     let renamed = false;
     let completed = false;
+    const completeCreate = params.overwrite === false && params.input.kind !== "file" && params.input.stageBeforePublish === true;
+    let receipt;
+    let publication = Object.freeze({ status: "not-published" });
+    let phase = "prepare";
+    let failure;
+    const closeTemp = async () => {
+        const handle = privateHandle;
+        const fd = tempFd;
+        privateHandle = undefined;
+        tempFd = undefined;
+        if (handle)
+            await handle.close();
+        else if (fd !== undefined)
+            closeFd(fd);
+    };
     try {
         tempName = `.fs-safe-${randomUUID()}.tmp`;
         params.assertBeforeMutation?.();
-        tempFd = binding.openBeneath(parentFd, tempName, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL)).fd;
+        if (params.private) {
+            const parentIdentity = fsSync.fstatSync(parentFd, { bigint: true });
+            privateHandle = await createFileHandle(path.join(parentPath, tempName), {
+                private: true,
+                mode: 0o600,
+                assertBeforeMutation: params.assertBeforeMutation,
+            }, {
+                expectedParentIdentity: {
+                    dev: parentIdentity.dev, ino: parentIdentity.ino, realPath: parentPath,
+                },
+            });
+            tempFd = privateHandle.fd;
+        }
+        else {
+            tempFd = binding.openBeneath(parentFd, tempName, nativeOpenFlags(fsSync.constants.O_WRONLY | fsSync.constants.O_CREAT | fsSync.constants.O_EXCL)).fd;
+        }
         const verificationIdentity = inspectFileIdentitySync(() => fsSync.fstatSync(tempFd, { bigint: true }));
         tempIdentity = verificationIdentity;
         // Creation is requested at 0600 in the binding, but a restrictive umask
         // can remove owner access. Keep the unpublished inode private and
         // reopenable until the published name has been identity-fenced.
         fsSync.fchmodSync(tempFd, 0o600);
-        await writeNativeInput(tempFd, params.input, params.maxBytes, params.assertBeforeMutation);
-        if (params.sync !== false)
-            syncFileBestEffortSync(tempFd);
+        await writePinnedInput(tempFd, params.input, params.maxBytes, params.assertBeforeMutation);
+        if (params.sync !== false) {
+            if (params.strictFileSync)
+                fsSync.fsyncSync(tempFd);
+            else
+                syncFileBestEffortSync(tempFd);
+        }
         if (params.input.kind === "file")
             await params.input.verifySource();
+        if (completeCreate) {
+            const parentIdentity = readParentIdentity(parentFd, parentGuard);
+            receipt = createStagedFileReceipt(Object.freeze({
+                path: parentGuard.dir,
+                realPath: parentGuard.realPath,
+                identity: Object.freeze({ dev: parentIdentity.dev, ino: parentIdentity.ino }),
+            }), tempName, fsSync.fstatSync(tempFd, { bigint: true }));
+        }
+        phase = "publish";
         assertFinalSymlinkRejected(path.join(parentPath, params.basename), params.rejectFinalSymlink);
         params.assertBeforeMutation?.();
-        if (params.overwrite === false) {
-            binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+        if (params.assertBeforeMutation) {
+            // Callbacks can replace names synchronously. Fence the named parent and
+            // stage against retained descriptors before the rename can expose bytes.
+            assertNamedParentCurrent(binding, parentGuard, readParentIdentity(parentFd, parentGuard));
+            publicationProbeFd = binding.openBeneath(parentFd, tempName, nativeOpenFlags(fsSync.constants.O_RDONLY)).fd;
+            const named = inspectFileIdentitySync(() => fsSync.fstatSync(publicationProbeFd, { bigint: true }), verificationIdentity);
+            const retained = inspectFileIdentitySync(() => fsSync.fstatSync(tempFd, { bigint: true }), verificationIdentity);
+            if (!named.isFile() || !retained.isFile() || named.nlink !== 1n || retained.nlink !== 1n) {
+                throw new FsSafeError("path-mismatch", "native write stage changed before publication");
+            }
+            assertFinalSymlinkRejected(path.join(parentPath, params.basename), params.rejectFinalSymlink);
         }
-        else {
-            binding.renameReplace(parentFd, tempName, parentFd, params.basename);
+        try {
+            if (params.overwrite === false) {
+                binding.renameNoReplace(parentFd, tempName, parentFd, params.basename);
+            }
+            else {
+                binding.renameReplace(parentFd, tempName, parentFd, params.basename);
+            }
+        }
+        catch (error) {
+            if (completeCreate && classifyNativeRenameFailure(error) === "indeterminate") {
+                publication = Object.freeze({ status: "indeterminate", basename: params.basename, overwrite: false });
+            }
+            throw error;
         }
         renamed = true;
+        if (receipt)
+            publication = Object.freeze({ status: "published", staged: receipt, basename: params.basename, overwrite: false });
         params.onPublished?.(verificationIdentity);
         targetFd = binding.openBeneath(parentFd, params.basename, nativeOpenFlags(fsSync.constants.O_RDONLY)).fd;
         const targetStat = inspectFileIdentitySync(() => fsSync.fstatSync(targetFd, { bigint: true }), verificationIdentity);
@@ -62,15 +161,21 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
         // verifiable and so broader modes are never exposed before that fence.
         try {
             fsSync.fchmodSync(targetFd, params.mode);
-            if (params.sync !== false)
-                syncFileBestEffortSync(targetFd);
+            // Windows FlushFileBuffers needs write access; the verification reopen is read-only.
+            if (params.sync !== false) {
+                if (params.strictFileSync)
+                    fsSync.fsyncSync(tempFd);
+                else
+                    syncFileBestEffortSync(tempFd);
+            }
         }
         catch (error) {
-            closeWriteFd(closeFd, targetFd);
-            targetFd = undefined;
+            if (!completeCreate) {
+                closeWriteFd(closeFd, targetFd);
+                targetFd = undefined;
+            }
             // Staged copies and streamed creates preserve publication for caller recovery.
-            if (params.input.kind === "buffer" ||
-                (params.input.kind === "stream" && !params.input.stageBeforePublish)) {
+            if (params.input.kind !== "file" && !params.input.stageBeforePublish) {
                 removeNativeCreatedFileIfStillPinned({
                     parentPath,
                     parentFd,
@@ -87,21 +192,61 @@ export async function runPinnedWriteWindows(binding, params, root, parentFd, par
         completed = true;
         return { dev: targetIdentity.dev, ino: targetIdentity.ino };
     }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
     finally {
-        const targetCloseError = closeWriteFd(closeFd, targetFd);
-        const tempCloseError = closeWriteFd(closeFd, tempFd);
-        if (!renamed) {
-            removeNativeCreatedFileIfStillPinned({
-                parentPath,
-                parentFd,
-                basename: tempName,
-                created: tempIdentity,
+        const preservedPreparation = params.private && tempFd === undefined && hasPreservedCreationArtifacts(failure?.error);
+        if (completeCreate || preservedPreparation) {
+            await settleStagedFile({
+                temporaryBasename: tempName, publication, phase, failure,
+                cleanup: async () => {
+                    if (preservedPreparation)
+                        return "preserved";
+                    if (publication.status === "indeterminate")
+                        return "preserved";
+                    if (renamed || tempFd === undefined)
+                        return "not-needed";
+                    return await cleanupPinnedFilePath({
+                        pathname: path.join(parentPath, tempName), handle: { fd: tempFd },
+                        identity: tempIdentity, parentGuard, throwOnCleanupError: true,
+                    });
+                },
+                close: [
+                    () => { if (targetFd !== undefined)
+                        closeFd(targetFd); },
+                    () => { if (publicationProbeFd !== undefined)
+                        closeFd(publicationProbeFd); },
+                    closeTemp,
+                    () => closeFd(parentFd),
+                    () => root.close(),
+                ],
             });
         }
-        const parentCloseError = closeWriteFd(closeFd, parentFd);
-        await root.close().catch(() => undefined);
-        const closeError = targetCloseError ?? tempCloseError ?? parentCloseError;
-        if (completed && closeError !== undefined)
-            throw closeError;
+        else {
+            const targetCloseFailure = closeWriteFd(closeFd, targetFd);
+            const probeCloseFailure = closeWriteFd(closeFd, publicationProbeFd);
+            let tempCloseFailure;
+            try {
+                await closeTemp();
+            }
+            catch (error) {
+                tempCloseFailure = { error };
+            }
+            if (!renamed) {
+                removeNativeCreatedFileIfStillPinned({
+                    parentPath,
+                    parentFd,
+                    basename: tempName,
+                    created: tempIdentity,
+                });
+            }
+            const parentCloseFailure = closeWriteFd(closeFd, parentFd);
+            await root.close().catch(() => undefined);
+            const closeFailure = targetCloseFailure ?? probeCloseFailure ?? tempCloseFailure ?? parentCloseFailure;
+            if (completed && closeFailure)
+                throw closeFailure.error;
+        }
     }
 }

package/dist/native-pinned-write.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAIV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AA8W3B,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsGvH"}
+{"version":3,"file":"native-pinned-write.d.ts","sourceRoot":"","sources":["../src/native-pinned-write.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAK3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAIV,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AA8W3B,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA8GvH"}

package/dist/native-pinned-write.js

@@ -55,6 +55,7 @@ import path from "node:path";
 import { inspectDirectoryIdentity } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { runPinnedWriteWindows } from "./native-pinned-write-windows.js";
+import { capturePolicyAwareWindowsParent } from "./native-policy-parent-windows.js";
 import { openNativeParentAdmission, openNativeRootAdmission } from "./native-parent-admission.js";
 import { assertNativeStaging, writeNativeStage } from "./native-staged-file.js";
 import { captureNativeFdClose } from "./native-binding.js";
@@ -367,15 +368,18 @@ export async function runPinnedWriteNative(binding, params) {
             assertNativeStaging(binding);
         }
         const directoryFlags = fsSync.constants.O_RDONLY | (fsSync.constants.O_DIRECTORY ?? 0);
+        const completeCreate = params.overwrite === false && params.input.kind !== "file" && params.input.stageBeforePublish === true;
         const rootAdmission = await openNativeRootAdmission(binding, {
             rootPath: params.rootPath,
             rootIdentity: params.rootIdentity,
             operation: "native write",
+            reportCloseErrors: completeCreate,
         });
         const root = rootAdmission.root;
         const posixRoot = __addDisposableResource(env_2, windows ? undefined : root, true);
         let parentFd;
         let windowsOwnsDirectories = false;
+        let admissionFailure;
         // Until stage construction takes ownership, even admission failures must close
         // the raw POSIX parent. Disposal preserves both admission and close failures.
         const parentGuard = __addDisposableResource(env_2, {
@@ -389,14 +393,18 @@ export async function runPinnedWriteNative(binding, params) {
             let parentPath;
             let directory;
             let parentPathStat;
-            let policyParentAdmitted = false;
             if (!windows && params.mutationAdmission) {
                 const admitted = await capturePolicyAwarePosixParent(binding, params, root.fd, directoryFlags);
                 parentFd = admitted.parentFd;
                 parentPath = admitted.parentPath;
                 directory = admitted.directory;
                 parentPathStat = admitted.parentPathStat;
-                policyParentAdmitted = true;
+            }
+            else if (windows && params.mutationAdmission) {
+                const admitted = await capturePolicyAwareWindowsParent(binding, params, rootAdmission);
+                parentFd = admitted.fd;
+                parentPath = admitted.guard.realPath;
+                parentPathStat = admitted.guard.stat;
             }
             else {
                 if (params.mkdir) {
@@ -409,15 +417,6 @@ export async function runPinnedWriteNative(binding, params) {
                 directory = admitted.stagedDirectory;
                 parentPathStat = admitted.guard.stat;
             }
-            if (!policyParentAdmitted && params.mutationAdmission) {
-                const targetPath = path.join(parentPath, params.basename);
-                await authorizePinnedMutation(params, {
-                    targetPath,
-                    mutationPath: targetPath,
-                    phase: "parent",
-                });
-                await inspectDirectoryIdentity(parentPath, inspectFileIdentitySync(() => fsSync.fstatSync(parentFd, { bigint: true })));
-            }
             const verificationGuard = { dir: parentPath, realPath: parentPath, stat: parentPathStat };
             if (params.overwrite === false) {
                 try {
@@ -439,8 +438,13 @@ export async function runPinnedWriteNative(binding, params) {
             parentFd = undefined;
             return await writeNativeStage(binding, ownedParent, closeFd, directory, params, verificationGuard);
         }
+        catch (error) {
+            admissionFailure = { error };
+            throw error;
+        }
         finally {
             if (windows && !windowsOwnsDirectories) {
+                const closeErrors = [];
                 if (parentFd !== undefined) {
                     // Match the Windows leaf cleanup contract: an admission or identity
                     // failure remains primary, while every owned directory is still given
@@ -449,11 +453,19 @@ export async function runPinnedWriteNative(binding, params) {
                     try {
                         closeFd(parentFd);
                     }
-                    catch {
-                        // Best effort while propagating the operation failure.
+                    catch (error) {
+                        closeErrors.push(error);
                     }
                 }
-                await root.close().catch(() => undefined);
+                try {
+                    await root.close();
+                }
+                catch (error) {
+                    closeErrors.push(error);
+                }
+                if (completeCreate && closeErrors.length > 0) {
+                    throw new AggregateError([...(admissionFailure ? [admissionFailure.error] : []), ...closeErrors], "native create admission and close failed");
+                }
             }
         }
     }

package/dist/native-policy-parent-windows.d.ts

@@ -0,0 +1,14 @@
+import { type BigIntStats } from "node:fs";
+import { type AsyncDirectoryGuard } from "./directory-guard.js";
+import { type NativeRootAdmission } from "./native-parent-admission.js";
+import type { NativeBinding } from "./native.js";
+import type { PinnedWriteParams } from "./pinned-write.js";
+import { type MutationDirectoryObservation } from "./pinned-mutation-observation.js";
+type PolicyParent = {
+    fd: number;
+    guard: AsyncDirectoryGuard<BigIntStats>;
+    observation: MutationDirectoryObservation;
+};
+export declare function capturePolicyAwareWindowsParent(binding: NativeBinding, params: PinnedWriteParams, rootAdmission: NativeRootAdmission): Promise<PolicyParent>;
+export {};
+//# sourceMappingURL=native-policy-parent-windows.d.ts.map

package/dist/native-policy-parent-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-policy-parent-windows.d.ts","sourceRoot":"","sources":["../src/native-policy-parent-windows.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAKjD,OAAO,KAAK,EAAE,iBAAiB,EAAkG,MAAM,mBAAmB,CAAC;AAC3J,OAAO,EAA4B,KAAK,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAK/G,KAAK,YAAY,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IACxC,WAAW,EAAE,4BAA4B,CAAC;CAC3C,CAAC;AA4BF,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,mBAAmB,GACjC,OAAO,CAAC,YAAY,CAAC,CA+KvB"}