@openclaw/fs-safe 0.14.0 → 0.16.0

package/dist/secret-read-policy.js

@@ -1,6 +1,9 @@
 import { normalizeMaxBytes } from "./byte-budget.js";
 import { resolveHomeRelativePath } from "./home-dir.js";
+import fs, {} from "node:fs";
+import { assertNoUnsafeDeviceReadPath } from "./device-path.js";
 import { FsSafeError } from "./errors.js";
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
 export const DEFAULT_SECRET_FILE_MAX_BYTES = 16 * 1024;
 export function secretPathErrorCode(error) {
@@ -29,7 +32,7 @@ export function trimSecretFileContent(raw, label, resolvedPath) {
     }
     return secret;
 }
-export function resolveSecretReadPolicy(filePath, label, options) {
+export function prepareSecretRead(filePath, label, options) {
     const trimmedPath = filePath.trim();
     assertNoWindowsPathAlias(trimmedPath, "filesystem", `${label} file path uses a Windows filesystem namespace alias`);
     const resolvedPath = resolveHomeRelativePath(trimmedPath);
@@ -40,5 +43,26 @@ export function resolveSecretReadPolicy(filePath, label, options) {
     const maxBytes = normalizeMaxBytes(options.maxBytes, {
         defaultValue: DEFAULT_SECRET_FILE_MAX_BYTES,
     });
-    return { resolvedPath, maxBytes };
+    let rejectSymlink;
+    let previewStat;
+    try {
+        assertNoUnsafeDeviceReadPath(resolvedPath);
+        rejectSymlink = Boolean(options.rejectSymlink);
+        previewStat = inspectFileIdentitySync(() => inspectInput(`${label} file at ${resolvedPath} must not be a symlink.`));
+    }
+    catch (error) {
+        throw secretReadError(error instanceof FsSafeError ? error.code : secretPathErrorCode(error), "inspect", label, resolvedPath, error);
+    }
+    function inspectInput(symlinkMessage) {
+        const stat = rejectSymlink
+            ? fs.lstatSync(resolvedPath, { bigint: true })
+            : fs.statSync(resolvedPath, { bigint: true });
+        if (rejectSymlink && stat.isSymbolicLink()) {
+            throw new FsSafeError("symlink", symlinkMessage);
+        }
+        return stat;
+    }
+    const rejectHardlinks = options.rejectHardlinks !== false;
+    assertSecretFilePreview(previewStat, label, resolvedPath, maxBytes, rejectHardlinks);
+    return { resolvedPath, maxBytes, rejectSymlink, rejectHardlinks, previewStat, inspectInput };
 }

package/dist/secure-file-windows.d.ts

@@ -6,5 +6,11 @@ export declare function inspectSecureWindowsDescriptor(params: {
     identity: ExactIdentity;
     stat: Stats;
 }): PermissionCheck;
+/** Both mechanisms inspect the same borrowed handle; the caller owns its lifetime. */
+export declare function inspectSecureWindowsFile(params: {
+    fd: number;
+    identity: ExactIdentity;
+    stat: Stats;
+}): Promise<PermissionCheck>;
 export {};
 //# sourceMappingURL=secure-file-windows.d.ts.map

package/dist/secure-file-windows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-file-windows.d.ts","sourceRoot":"","sources":["../src/secure-file-windows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AASlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AA4BxD,KAAK,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;AAuHtD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC;CACb,GAAG,eAAe,CA0ClB"}
+{"version":3,"file":"secure-file-windows.d.ts","sourceRoot":"","sources":["../src/secure-file-windows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAOlD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAOxD,KAAK,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;AA0BtD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC;CACb,GAAG,eAAe,CAkBlB;AAgCD,sFAAsF;AACtF,wBAAsB,wBAAwB,CAAC,MAAM,EAAE;IACrD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,aAAa,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC;CACb,GAAG,OAAO,CAAC,eAAe,CAAC,CAiB3B"}

package/dist/secure-file-windows.js

@@ -1,30 +1,12 @@
 import { FsSafeError } from "./errors.js";
 import { recordFileObservationFailure } from "./file-observation.js";
 import { getNativeBinding } from "./native.js";
+import { getFsSafeNativeConfig } from "./native-config.js";
+import { warnNativeFallback } from "./native-fallback-warning.js";
+import { inspectWindowsDescriptorCommand } from "./windows-security-command.js";
+import { validateSecureWindowsSecurityFacts } from "./windows-security-facts.js";
 const IDENTITY_RE = /^([0-9a-f]{8}):([0-9a-f]{16})$/;
-const SID_RE = /^s-\d+-\d+(?:-\d+)+$/;
-const OWNER_CLASSES = new Set(["current-user", "system", "administrators", "foreign"]);
 const TRUSTED_OWNER_CLASSES = new Set(["current-user", "system", "administrators"]);
-const SYSTEM_SID = "s-1-5-18";
-const ADMINISTRATORS_SID = "s-1-5-32-544";
-const WORLD_SIDS = new Set([
-    "s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7",
-    "s-1-5-32-546", "s-1-5-4", "s-1-5-2",
-]);
-const GENERIC_READ = 0x8000_0000;
-const GENERIC_WRITE = 0x4000_0000;
-const GENERIC_ALL = 0x1000_0000;
-const DELETE_ACCESS = 0x0001_0000;
-const WRITE_DAC = 0x0004_0000;
-const WRITE_OWNER = 0x0008_0000;
-const FILE_READ_DATA = 0x0000_0001;
-const FILE_WRITE_DATA = 0x0000_0002;
-const FILE_APPEND_DATA = 0x0000_0004;
-const FILE_READ_EA = 0x0000_0008;
-const FILE_WRITE_EA = 0x0000_0010;
-const FILE_DELETE_CHILD = 0x0000_0040;
-const FILE_READ_ATTRIBUTES = 0x0000_0080;
-const FILE_WRITE_ATTRIBUTES = 0x0000_0100;
 function permissionUnverified(message, cause) {
     throw new FsSafeError("permission-unverified", message, cause === undefined ? {} : { cause });
 }
@@ -36,9 +18,6 @@ function identityMismatch() {
 function isRecord(value) {
     return typeof value === "object" && value !== null;
 }
-function isUint32(value) {
-    return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 0xffff_ffff;
-}
 function parseIdentity(value) {
     if (typeof value !== "string")
         identityMismatch();
@@ -50,95 +29,6 @@ function parseIdentity(value) {
         ino: BigInt(`0x${match[2]}`),
     };
 }
-function validateFlags(value) {
-    if (!isRecord(value))
-        return false;
-    const raw = value.raw;
-    if (!isUint32(raw) || (raw & ~0xdf) !== 0)
-        return false;
-    const fields = [
-        ["objectInherit", 0x01], ["containerInherit", 0x02],
-        ["noPropagateInherit", 0x04], ["inheritOnly", 0x08], ["inherited", 0x10],
-        ["successfulAccess", 0x40], ["failedAccess", 0x80],
-    ];
-    return fields.every(([field, bit]) => typeof value[field] === "boolean" && value[field] === ((raw & bit) !== 0));
-}
-function validateAce(value) {
-    return isRecord(value) && typeof value.sid === "string" && SID_RE.test(value.sid) &&
-        isUint32(value.mask) && (value.aceType === "allow" || value.aceType === "deny") &&
-        validateFlags(value.flags);
-}
-function canRead(mask) {
-    return (mask & (GENERIC_ALL | GENERIC_READ | FILE_READ_DATA | FILE_READ_EA |
-        FILE_READ_ATTRIBUTES)) !== 0;
-}
-function canWrite(mask) {
-    return (mask & (GENERIC_ALL | GENERIC_WRITE | FILE_WRITE_DATA | FILE_APPEND_DATA |
-        FILE_WRITE_EA | FILE_WRITE_ATTRIBUTES | FILE_DELETE_CHILD | DELETE_ACCESS |
-        WRITE_DAC | WRITE_OWNER)) !== 0;
-}
-function expectedOwnerClass(facts) {
-    if (facts.ownerSid === facts.currentUserSid)
-        return "current-user";
-    if (facts.ownerSid === SYSTEM_SID)
-        return "system";
-    if (facts.ownerSid === ADMINISTRATORS_SID)
-        return "administrators";
-    return "foreign";
-}
-function validateSecurity(value) {
-    if (!isRecord(value))
-        permissionUnverified("Windows descriptor ACL facts were malformed");
-    const facts = value;
-    const booleans = [
-        "worldWritable", "groupWritable", "worldReadable", "groupReadable",
-        "fallbackRequired", "daclPresent", "isLocal", "aceListComplete",
-    ];
-    if (!booleans.every((field) => typeof facts[field] === "boolean") ||
-        typeof facts.ownerSid !== "string" || !SID_RE.test(facts.ownerSid) ||
-        typeof facts.currentUserSid !== "string" || !SID_RE.test(facts.currentUserSid) ||
-        typeof facts.ownerClass !== "string" || !OWNER_CLASSES.has(facts.ownerClass) ||
-        !Array.isArray(facts.unsupportedAceTypes) ||
-        !facts.unsupportedAceTypes.every(isUint32) ||
-        !Array.isArray(facts.aces) || !facts.aces.every(validateAce)) {
-        permissionUnverified("Windows descriptor ACL facts were malformed");
-    }
-    if (facts.ownerClass !== expectedOwnerClass(facts)) {
-        permissionUnverified("Windows descriptor owner facts were inconsistent");
-    }
-    if (facts.fallbackRequired || !facts.isLocal || !facts.aceListComplete ||
-        facts.unsupportedAceTypes.length !== 0) {
-        permissionUnverified("Windows descriptor ACL facts were incomplete or unsupported");
-    }
-    if (!facts.daclPresent && facts.aces.length !== 0) {
-        permissionUnverified("Windows descriptor DACL facts were inconsistent");
-    }
-    return facts;
-}
-function validatePermissionSummary(facts) {
-    let worldReadable = !facts.daclPresent;
-    let worldWritable = !facts.daclPresent;
-    let groupReadable = false;
-    let groupWritable = false;
-    const trustedSids = new Set([facts.currentUserSid, SYSTEM_SID, ADMINISTRATORS_SID]);
-    for (const ace of facts.aces) {
-        if (ace.aceType !== "allow" || ace.flags.inheritOnly || trustedSids.has(ace.sid))
-            continue;
-        const world = WORLD_SIDS.has(ace.sid);
-        if (world) {
-            worldReadable ||= canRead(ace.mask);
-            worldWritable ||= canWrite(ace.mask);
-        }
-        else {
-            groupReadable ||= canRead(ace.mask);
-            groupWritable ||= canWrite(ace.mask);
-        }
-    }
-    if (facts.worldReadable !== worldReadable || facts.worldWritable !== worldWritable ||
-        facts.groupReadable !== groupReadable || facts.groupWritable !== groupWritable) {
-        permissionUnverified("Windows descriptor ACL summary was inconsistent");
-    }
-}
 export function inspectSecureWindowsDescriptor(params) {
     let native;
     try {
@@ -158,14 +48,16 @@ export function inspectSecureWindowsDescriptor(params) {
     catch (cause) {
         permissionUnverified("Windows descriptor ACL verification failed", cause);
     }
+    return inspectDescriptorResult(params, result, "native");
+}
+function inspectDescriptorResult(params, result, mechanism) {
     if (!isRecord(result))
         permissionUnverified("Windows descriptor ACL facts were malformed");
     const observed = parseIdentity(result.identity);
     if (observed.dev !== params.identity.dev || observed.ino !== params.identity.ino) {
         identityMismatch();
     }
-    const facts = validateSecurity(result.security);
-    validatePermissionSummary(facts);
+    const facts = validateSecureWindowsSecurityFacts(result.security);
     return {
         ok: true,
         isSymlink: false,
@@ -179,8 +71,33 @@ export function inspectSecureWindowsDescriptor(params) {
         groupReadable: facts.groupReadable,
         ownerSid: facts.ownerSid,
         ownerTrusted: TRUSTED_OWNER_CLASSES.has(facts.ownerClass),
-        aclSummary: `native descriptor owner=${facts.ownerClass} world=` +
+        aclSummary: `${mechanism} descriptor owner=${facts.ownerClass} world=` +
             `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
             `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
     };
 }
+/** Both mechanisms inspect the same borrowed handle; the caller owns its lifetime. */
+export async function inspectSecureWindowsFile(params) {
+    let native;
+    try {
+        native = getNativeBinding();
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification requires the matching native helper", cause);
+    }
+    if (typeof native?.inspectWindowsSecureFileHandle === "function") {
+        return inspectSecureWindowsDescriptor(params);
+    }
+    if (getFsSafeNativeConfig().mode === "require") {
+        permissionUnverified("Windows descriptor ACL verification requires an up-to-date native helper");
+    }
+    warnNativeFallback("windows-secure-file", "Windows descriptor ACL inspection uses a slower built-in system command.");
+    let result;
+    try {
+        result = await inspectWindowsDescriptorCommand(params.fd);
+    }
+    catch (cause) {
+        permissionUnverified("Windows descriptor ACL verification failed", cause);
+    }
+    return inspectDescriptorResult(params, result, "system-command");
+}

package/dist/secure-file.js

@@ -13,7 +13,7 @@ import { resolveReadOpenFlags } from "./read-open-flags.js";
 import { realpathSync } from "./realpath.js";
 import { inspectPathPermissions, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, } from "./permissions.js";
 import { inspectFileIdentity } from "./strict-file-identity.js";
-import { inspectSecureWindowsDescriptor } from "./secure-file-windows.js";
+import { inspectSecureWindowsFile } from "./secure-file-windows.js";
 import { scheduleTimeout } from "./timing.js";
 import { anchorWindowsDriveRelativePath, assertNoWindowsPathAlias, resolvePathPreservingWindowsRoot, } from "./windows-path-alias.js";
 function snapshotTrustedDirs(dirs) {
@@ -209,7 +209,7 @@ async function assertSecurePermissions(options, stat, realPath, identity, fd) {
     const platform = options.inject?.platform ?? process.platform;
     const permissions = platform === "win32"
         ? process.platform === "win32"
-            ? inspectSecureWindowsDescriptor({ fd, identity, stat })
+            ? await inspectSecureWindowsFile({ fd, identity, stat })
             : await inspectPathPermissions(realPath, options.inject)
         : inspectOpenedPermissions(stat, platform);
     const reason = permissions.error ? `: ${formatPermissionErrorDetail(permissions.error)}` : "";

package/dist/sibling-temp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sibling-temp.d.ts","sourceRoot":"","sources":["../src/sibling-temp.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AASF,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CA0BxC;AAwBD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsDhB"}
+{"version":3,"file":"sibling-temp.d.ts","sourceRoot":"","sources":["../src/sibling-temp.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,2BAA2B,CAAC,CAAC,IAAI;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,MAAM,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uGAAuG;IACvG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,yEAAyE;IACzE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,CAAC,CAAC,IAAI;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,CAAC,CAAC;CACX,CAAC;AASF,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACtC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAkCxC;AAwBD,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDhB"}

package/dist/sibling-temp.js

@@ -25,25 +25,33 @@ export async function writeSiblingTempFile(options) {
     const dir = resolvePathPreservingWindowsRoot(dirInput);
     assertNoWindowsPathAlias(dir, "filesystem", "sibling temp directory uses a Windows filesystem namespace alias");
     const producerIsolation = options.producerIsolation;
-    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true, mode: options.dirMode ?? 0o700 });
-    if (options.chmodDir !== false) {
+    const dirMode = options.dirMode ?? 0o700;
+    const chmodDir = options.chmodDir !== false;
+    const tempPrefix = options.tempPrefix;
+    const writeTemp = options.writeTemp;
+    const resolveFinalPath = options.resolveFinalPath;
+    const mode = options.mode;
+    const syncTempFile = options.syncTempFile === true;
+    const syncParentDir = options.syncParentDir === true;
+    await fs.mkdir(recursiveMkdirPath(dir), { recursive: true, mode: dirMode });
+    if (chmodDir) {
         await applyDirectoryMode({
             fsModule: fs,
             dirPath: dir,
-            mode: options.dirMode ?? 0o700,
+            mode: dirMode,
             ignoreChmodError: true,
         });
     }
     return await writeCallbackSibling({
         tempDir: dir,
-        tempName: buildTempName(options.tempPrefix),
-        write: options.writeTemp,
+        tempName: buildTempName(tempPrefix),
+        write: writeTemp,
         producerIsolation,
-        resolveFinalPath: options.resolveFinalPath,
-        mode: options.mode,
+        resolveFinalPath,
+        mode,
         ignoreModeError: true,
-        syncTempFile: options.syncTempFile === true,
-        syncParentDir: options.syncParentDir === true,
+        syncTempFile,
+        syncParentDir,
     });
 }
 function buildSiblingTempName(params) {
@@ -91,6 +99,9 @@ export async function writeViaSiblingTempPath(params) {
         path.isAbsolute(relativeTargetPath)) {
         throw new Error("Target path is outside the allowed root");
     }
+    const writeTemp = params.writeTemp;
+    const fallbackFileName = params.fallbackFileName;
+    const tempPrefix = params.tempPrefix;
     const rootGuard = await createAsyncDirectoryGuard(rootDir);
     const workspace = await tempFile({
         rootDir: resolveSecureTempRoot({
@@ -104,12 +115,12 @@ export async function writeViaSiblingTempPath(params) {
     try {
         const tempName = buildSiblingTempName({
             targetPath: path.join(workspace.dir, path.basename(targetPath)),
-            fallbackFileName: params.fallbackFileName ?? "output.bin",
-            tempPrefix: params.tempPrefix ?? ".fs-safe-output-",
+            fallbackFileName: fallbackFileName ?? "output.bin",
+            tempPrefix: tempPrefix ?? ".fs-safe-output-",
         });
         const tempPath = resolveCallbackTempPath(workspace.dir, tempName);
         await getFsSafeTestHooks()?.beforeSiblingTempWrite?.(tempPath);
-        await params.writeTemp(tempPath);
+        await Function.prototype.call.call(writeTemp, params, tempPath);
         await assertAsyncDirectoryGuard(rootGuard);
         const targetRoot = await root(rootDir);
         await targetRoot.copyIn(relativeTargetPath, tempPath, { mkdir: false });

package/dist/sidecar-lock-acquire.d.ts

@@ -1,31 +1,5 @@
-import { type NativeFileHandle } from "./native-operations.js";
-import type { Root } from "./root-impl.js";
-import { type SidecarLockSnapshot } from "./sidecar-lock-reclaim.js";
 import type { SidecarLockAcquireOptions, SidecarLockHandle } from "./sidecar-lock-types.js";
-type SidecarFileHandle = Pick<NativeFileHandle, "fd" | "close" | "stat" | "writeFile">;
-export type HeldSidecarLock = {
-    refCount: number;
-    reentrantOwner?: string;
-    handle: SidecarFileHandle;
-    lockPath: string;
-    snapshot: SidecarLockSnapshot;
-    acquiredAt: number;
-    metadata: Record<string, unknown>;
-    releasePromise?: Promise<void>;
-    lockRoot?: Root;
-    retainOnExit?: boolean;
-    parsePayload?: (raw: string) => unknown;
-    compromiseTimer?: NodeJS.Timeout;
-};
-type SidecarLockAcquisitionContext = {
-    held: Map<string, HeldSidecarLock>;
-    reclaimGuards: Set<string>;
-    ensureExitCleanupRegistered(): void;
-    handleForHeldLock(normalizedTargetPath: string, held: HeldSidecarLock): SidecarLockHandle;
-    releaseHeldLock(normalizedTargetPath: string, held: HeldSidecarLock, options?: {
-        force?: boolean;
-    }): Promise<boolean>;
-};
+import { type SidecarLockAcquisitionContext } from "./sidecar-lock-admission.js";
+export type { HeldSidecarLock } from "./sidecar-lock-admission.js";
 export declare function acquireSidecarLock<TPayload extends Record<string, unknown>>(options: SidecarLockAcquireOptions<TPayload>, context: SidecarLockAcquisitionContext): Promise<SidecarLockHandle>;
-export {};
 //# sourceMappingURL=sidecar-lock-acquire.d.ts.map

package/dist/sidecar-lock-acquire.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sidecar-lock-acquire.d.ts","sourceRoot":"","sources":["../src/sidecar-lock-acquire.ts"],"names":[],"mappings":"AAUA,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1F,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAW3C,OAAO,EAWL,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAK5F,KAAK,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,CAAC;AAEvF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;CAClC,CAAC;AAEF,KAAK,6BAA6B,GAAG;IACnC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,2BAA2B,IAAI,IAAI,CAAC;IACpC,iBAAiB,CAAC,oBAAoB,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB,CAAC;IAC1F,eAAe,CACb,oBAAoB,EAAE,MAAM,EAC5B,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB,CAAC;AAoCF,wBAAsB,kBAAkB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/E,OAAO,EAAE,yBAAyB,CAAC,QAAQ,CAAC,EAC5C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,iBAAiB,CAAC,CA2U5B"}
+{"version":3,"file":"sidecar-lock-acquire.d.ts","sourceRoot":"","sources":["../src/sidecar-lock-acquire.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAM5F,OAAO,EAA4C,KAAK,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAM3H,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,wBAAsB,kBAAkB,CAAC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/E,OAAO,EAAE,yBAAyB,CAAC,QAAQ,CAAC,EAC5C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,iBAAiB,CAAC,CA0b5B"}