blun-king-cli 9.0.1 → 9.1.0

package/bin/private-paths.js

@@ -1,33 +1,1599 @@
 'use strict';
 
+const { execFileSync } = require('node:child_process');
 const fs = require('node:fs');
+const path = require('node:path');
+const { gzipSync } = require('node:zlib');
 
 const PRIVATE_DIRECTORY_MODE = 0o700;
 const PRIVATE_FILE_MODE = 0o600;
+const PRIVATE_TREE_MAX_DEPTH = 64;
+const PRIVATE_TREE_MAX_ENTRIES = 4096;
+const PRIVATE_TREE_MAX_PATH_LENGTH = 4096;
+const WINDOWS_ACL_OK_SENTINEL = 'BLUN_PRIVATE_ACL_OK_V1';
+const WINDOWS_SID_PATTERN = /S-\d-\d+(?:-\d+)+/gi;
+const WINDOWS_LOCAL_DOS_PATH_PATTERN = /^[A-Za-z]:\\/u;
+const WINDOWS_RESERVED_PATH_SEGMENT = /^(?:CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|COM[1-9]|LPT[1-9])(?:\..*)?$/iu;
 
-function applyPosixMode(targetPath, mode, options = {}) {
-  const fsImpl = options.fsImpl || fs;
-  const platform = options.platform || process.platform;
+const WINDOWS_ACL_CSHARP = String.raw`using Microsoft.Win32.SafeHandles;
+using System;
+using System.Collections.Generic;
+using System.ComponentModel;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Text;
+
+public static class BlunPrivateAclNative
+{
+    private const uint GENERIC_READ = 0x80000000;
+    private const uint GENERIC_WRITE = 0x40000000;
+    private const uint DELETE = 0x00010000;
+    private const uint READ_CONTROL = 0x00020000;
+    private const uint WRITE_DAC = 0x00040000;
+    private const uint SYNCHRONIZE = 0x00100000;
+    private const uint CREATE_NEW = 1;
+    private const uint OPEN_EXISTING = 3;
+    private const uint FILE_ATTRIBUTE_NORMAL = 0x00000080;
+    private const uint FILE_ATTRIBUTE_DIRECTORY = 0x00000010;
+    private const uint FILE_ATTRIBUTE_DEVICE = 0x00000040;
+    private const uint FILE_ATTRIBUTE_REPARSE_POINT = 0x00000400;
+    private const uint FILE_FLAG_BACKUP_SEMANTICS = 0x02000000;
+    private const uint FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000;
+    private const uint FILE_DIRECTORY_FILE = 0x00000001;
+    private const uint FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;
+    private const uint FILE_OPEN_REPARSE_POINT = 0x00200000;
+    private const uint FILE_OPEN_IF = 3;
+    private const uint OBJ_CASE_INSENSITIVE = 0x00000040;
+    private const uint SE_FILE_OBJECT = 1;
+    private const uint OWNER_SECURITY_INFORMATION = 0x00000001;
+    private const uint DACL_SECURITY_INFORMATION = 0x00000004;
+    private const uint PROTECTED_DACL_SECURITY_INFORMATION = 0x80000000;
+    private const int FILE_DISPOSITION_INFO_CLASS = 4;
+    private const int FILE_STANDARD_INFO_CLASS = 1;
+    private const int FILE_REMOTE_PROTOCOL_INFO_CLASS = 13;
+    private const int FILE_ID_BOTH_DIRECTORY_INFORMATION_CLASS = 37;
+    private const int FILE_STANDARD_INFO_BUFFER_SIZE = 24;
+    private const int REMOTE_PROTOCOL_INFO_BUFFER_SIZE = 256;
+    private const int DIRECTORY_INFORMATION_BUFFER_SIZE = 65536;
+    private const int DIRECTORY_INFORMATION_FILE_ID_OFFSET = 96;
+    private const int DIRECTORY_INFORMATION_NAME_OFFSET = 104;
+    private const int MAX_TREE_DEPTH = 64;
+    private const int MAX_TREE_ENTRIES = 4096;
+    private const int MAX_TREE_PATH_LENGTH = 4096;
+    private const int ERROR_INVALID_PARAMETER = 87;
+    private const uint FILE_TYPE_DISK = 1;
+    private const int STATUS_NO_MORE_FILES = unchecked((int)0x80000006);
+
+    private sealed class TreeEntry
+    {
+        public string Name;
+        public uint Attributes;
+        public ulong FileId;
+    }
+
+    private sealed class HeldTreeHandle
+    {
+        public SafeFileHandle Handle;
+        public string Path;
+        public bool Directory;
+        public string Owner;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct SecurityAttributes
+    {
+        public int Length;
+        public IntPtr SecurityDescriptor;
+        [MarshalAs(UnmanagedType.Bool)] public bool InheritHandle;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FileTime
+    {
+        public uint Low;
+        public uint High;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ByHandleFileInformation
+    {
+        public uint FileAttributes;
+        public FileTime CreationTime;
+        public FileTime LastAccessTime;
+        public FileTime LastWriteTime;
+        public uint VolumeSerialNumber;
+        public uint FileSizeHigh;
+        public uint FileSizeLow;
+        public uint NumberOfLinks;
+        public uint FileIndexHigh;
+        public uint FileIndexLow;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct FileDispositionInfo
+    {
+        [MarshalAs(UnmanagedType.Bool)] public bool DeleteFile;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct UnicodeString
+    {
+        public ushort Length;
+        public ushort MaximumLength;
+        public IntPtr Buffer;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct ObjectAttributes
+    {
+        public int Length;
+        public IntPtr RootDirectory;
+        public IntPtr ObjectName;
+        public uint Attributes;
+        public IntPtr SecurityDescriptor;
+        public IntPtr SecurityQualityOfService;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct IoStatusBlock
+    {
+        public IntPtr Status;
+        public UIntPtr Information;
+    }
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true,
+        EntryPoint = "CreateFileW")]
+    private static extern SafeFileHandle CreateFileNew(
+        string fileName,
+        uint desiredAccess,
+        uint shareMode,
+        ref SecurityAttributes securityAttributes,
+        uint creationDisposition,
+        uint flagsAndAttributes,
+        IntPtr templateFile);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true,
+        EntryPoint = "CreateFileW")]
+    private static extern SafeFileHandle CreateFileExisting(
+        string fileName,
+        uint desiredAccess,
+        uint shareMode,
+        IntPtr securityAttributes,
+        uint creationDisposition,
+        uint flagsAndAttributes,
+        IntPtr templateFile);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandle(
+        SafeFileHandle handle,
+        out ByHandleFileInformation information);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern uint GetFileType(SafeFileHandle handle);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetFileInformationByHandleEx(
+        SafeFileHandle handle,
+        int informationClass,
+        IntPtr information,
+        uint bufferSize);
+
+    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    private static extern uint GetFinalPathNameByHandleW(
+        SafeFileHandle handle,
+        StringBuilder path,
+        uint pathLength,
+        uint flags);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool SetFileInformationByHandle(
+        SafeFileHandle handle,
+        int informationClass,
+        ref FileDispositionInfo information,
+        uint bufferSize);
+
+    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool ConvertStringSecurityDescriptorToSecurityDescriptorW(
+        string stringSecurityDescriptor,
+        uint stringSdRevision,
+        out IntPtr securityDescriptor,
+        out uint securityDescriptorSize);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetSecurityDescriptorDacl(
+        IntPtr securityDescriptor,
+        [MarshalAs(UnmanagedType.Bool)] out bool daclPresent,
+        out IntPtr dacl,
+        [MarshalAs(UnmanagedType.Bool)] out bool daclDefaulted);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern uint SetSecurityInfo(
+        SafeFileHandle handle,
+        uint objectType,
+        uint securityInformation,
+        IntPtr owner,
+        IntPtr group,
+        IntPtr dacl,
+        IntPtr sacl);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern uint GetSecurityInfo(
+        SafeFileHandle handle,
+        uint objectType,
+        uint securityInformation,
+        out IntPtr owner,
+        out IntPtr group,
+        out IntPtr dacl,
+        out IntPtr sacl,
+        out IntPtr securityDescriptor);
+
+    [DllImport("advapi32.dll", SetLastError = true)]
+    private static extern uint GetSecurityDescriptorLength(IntPtr securityDescriptor);
+
+    [DllImport("kernel32.dll")]
+    private static extern IntPtr LocalFree(IntPtr memory);
+
+    [DllImport("ntdll.dll")]
+    private static extern int NtCreateFile(
+        out IntPtr fileHandle,
+        uint desiredAccess,
+        ref ObjectAttributes objectAttributes,
+        out IoStatusBlock ioStatusBlock,
+        IntPtr allocationSize,
+        uint fileAttributes,
+        uint shareAccess,
+        uint createDisposition,
+        uint createOptions,
+        IntPtr eaBuffer,
+        uint eaLength);
+
+    [DllImport("ntdll.dll")]
+    private static extern uint RtlNtStatusToDosError(int status);
+
+    [DllImport("ntdll.dll")]
+    private static extern int NtQueryDirectoryFile(
+        SafeFileHandle fileHandle,
+        IntPtr eventHandle,
+        IntPtr apcRoutine,
+        IntPtr apcContext,
+        out IoStatusBlock ioStatusBlock,
+        IntPtr fileInformation,
+        uint length,
+        int fileInformationClass,
+        [MarshalAs(UnmanagedType.U1)] bool returnSingleEntry,
+        IntPtr fileName,
+        [MarshalAs(UnmanagedType.U1)] bool restartScan);
+
+    private static HashSet<string> ExpectedSids(string userSid)
+    {
+        SecurityIdentifier user = new SecurityIdentifier(userSid);
+        HashSet<string> expected = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        expected.Add(user.Value);
+        expected.Add("S-1-5-18");
+        expected.Add("S-1-5-32-544");
+        return expected;
+    }
+
+    private static string ExactDaclSddl(string userSid, bool directory)
+    {
+        string flags = directory ? "OICI" : "";
+        string[] trustees = new string[] {
+            new SecurityIdentifier(userSid).Value,
+            "S-1-5-18",
+            "S-1-5-32-544"
+        };
+        HashSet<string> seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        StringBuilder builder = new StringBuilder("D:P");
+        foreach (string trustee in trustees)
+        {
+            if (!seen.Add(trustee)) continue;
+            builder.Append("(A;").Append(flags).Append(";FA;;;")
+                .Append(trustee).Append(")");
+        }
+        return builder.ToString();
+    }
+
+    private static IntPtr CreateExactDescriptor(string userSid, bool directory)
+    {
+        IntPtr descriptor;
+        uint descriptorSize;
+        if (!ConvertStringSecurityDescriptorToSecurityDescriptorW(
+            ExactDaclSddl(userSid, directory), 1, out descriptor, out descriptorSize))
+        {
+            throw new Win32Exception(Marshal.GetLastWin32Error());
+        }
+        return descriptor;
+    }
+
+    private static void SetExactDacl(SafeFileHandle handle, string userSid, bool directory)
+    {
+        IntPtr descriptor = CreateExactDescriptor(userSid, directory);
+        try
+        {
+            bool present;
+            bool defaulted;
+            IntPtr dacl;
+            if (!GetSecurityDescriptorDacl(descriptor, out present, out dacl, out defaulted)
+                || !present || dacl == IntPtr.Zero)
+            {
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            }
+            uint result = SetSecurityInfo(
+                handle,
+                SE_FILE_OBJECT,
+                DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION,
+                IntPtr.Zero,
+                IntPtr.Zero,
+                dacl,
+                IntPtr.Zero);
+            if (result != 0) throw new Win32Exception((int)result);
+        }
+        finally
+        {
+            LocalFree(descriptor);
+        }
+    }
+
+    private static RawSecurityDescriptor ReadAccessDescriptor(SafeFileHandle handle)
+    {
+        IntPtr owner;
+        IntPtr group;
+        IntPtr dacl;
+        IntPtr sacl;
+        IntPtr descriptor;
+        uint result = GetSecurityInfo(
+            handle,
+            SE_FILE_OBJECT,
+            OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION,
+            out owner,
+            out group,
+            out dacl,
+            out sacl,
+            out descriptor);
+        if (result != 0) throw new Win32Exception((int)result);
+        try
+        {
+            uint length = GetSecurityDescriptorLength(descriptor);
+            if (length == 0 || length > 65536) throw new InvalidDataException();
+            byte[] bytes = new byte[length];
+            Marshal.Copy(descriptor, bytes, 0, (int)length);
+            return new RawSecurityDescriptor(bytes, 0);
+        }
+        finally
+        {
+            LocalFree(descriptor);
+        }
+    }
+
+    private static string ValidateOwner(
+        SafeFileHandle handle,
+        HashSet<string> expectedSids)
+    {
+        RawSecurityDescriptor descriptor = ReadAccessDescriptor(handle);
+        if (descriptor.Owner == null || !expectedSids.Contains(descriptor.Owner.Value))
+            throw new UnauthorizedAccessException();
+        return descriptor.Owner.Value;
+    }
+
+    private static void VerifyExactDacl(
+        SafeFileHandle handle,
+        string userSid,
+        bool directory,
+        string expectedOwner)
+    {
+        HashSet<string> expectedSids = ExpectedSids(userSid);
+        RawSecurityDescriptor descriptor = ReadAccessDescriptor(handle);
+        if (descriptor.Owner == null
+            || !String.Equals(descriptor.Owner.Value, expectedOwner, StringComparison.OrdinalIgnoreCase))
+            throw new UnauthorizedAccessException();
+        if ((descriptor.ControlFlags & ControlFlags.DiscretionaryAclProtected) == 0)
+            throw new UnauthorizedAccessException();
+        RawAcl acl = descriptor.DiscretionaryAcl;
+        if (acl == null || acl.Count != expectedSids.Count)
+            throw new UnauthorizedAccessException();
+
+        AceFlags expectedFlags = directory
+            ? AceFlags.ObjectInherit | AceFlags.ContainerInherit
+            : AceFlags.None;
+        HashSet<string> seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        foreach (GenericAce genericAce in acl)
+        {
+            CommonAce ace = genericAce as CommonAce;
+            if (ace == null
+                || ace.AceQualifier != AceQualifier.AccessAllowed
+                || ace.AccessMask != (int)FileSystemRights.FullControl
+                || ace.AceFlags != expectedFlags
+                || ace.SecurityIdentifier == null
+                || !expectedSids.Contains(ace.SecurityIdentifier.Value)
+                || !seen.Add(ace.SecurityIdentifier.Value))
+            {
+                throw new UnauthorizedAccessException();
+            }
+        }
+        if (!seen.SetEquals(expectedSids)) throw new UnauthorizedAccessException();
+    }
+
+    private static ByHandleFileInformation ValidateHandle(
+        SafeFileHandle handle,
+        bool directory)
+    {
+        ByHandleFileInformation information;
+        if (!GetFileInformationByHandle(handle, out information))
+            throw new Win32Exception(Marshal.GetLastWin32Error());
+        bool actualDirectory = (information.FileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0;
+        if (actualDirectory != directory
+            || (information.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) != 0)
+        {
+            throw new UnauthorizedAccessException();
+        }
+        if (GetFileType(handle) != FILE_TYPE_DISK)
+            throw new UnauthorizedAccessException();
+        if (!directory) VerifyFreshFileState(handle, false, true);
+        VerifyLocalHandle(handle);
+        return information;
+    }
+
+    private static ulong FileId(ByHandleFileInformation information)
+    {
+        return ((ulong)information.FileIndexHigh << 32) | information.FileIndexLow;
+    }
+
+    private static void VerifyTreeHandleIdentity(SafeFileHandle handle, ulong expectedFileId)
+    {
+        ByHandleFileInformation information;
+        if (!GetFileInformationByHandle(handle, out information))
+            throw new Win32Exception(Marshal.GetLastWin32Error());
+        ulong actualFileId = FileId(information);
+        if (expectedFileId == 0 || actualFileId == 0 || actualFileId != expectedFileId)
+            throw new UnauthorizedAccessException();
+    }
+
+    private static void VerifyFreshFileState(
+        SafeFileHandle handle,
+        bool expectedDeletePending,
+        bool requireSingleLink)
+    {
+        IntPtr buffer = Marshal.AllocHGlobal(FILE_STANDARD_INFO_BUFFER_SIZE);
+        try
+        {
+            for (int offset = 0; offset < FILE_STANDARD_INFO_BUFFER_SIZE; offset += 4)
+                Marshal.WriteInt32(buffer, offset, 0);
+            if (!GetFileInformationByHandleEx(
+                handle,
+                FILE_STANDARD_INFO_CLASS,
+                buffer,
+                FILE_STANDARD_INFO_BUFFER_SIZE))
+            {
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            }
+            uint numberOfLinks = unchecked((uint)Marshal.ReadInt32(buffer, 16));
+            bool deletePending = Marshal.ReadByte(buffer, 20) != 0;
+            bool directory = Marshal.ReadByte(buffer, 21) != 0;
+            if (directory
+                || deletePending != expectedDeletePending
+                || (requireSingleLink ? numberOfLinks != 1 : numberOfLinks > 1))
+            {
+                throw new UnauthorizedAccessException();
+            }
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(buffer);
+        }
+    }
+
+    private static void VerifyLocalHandle(SafeFileHandle handle)
+    {
+        IntPtr buffer = Marshal.AllocHGlobal(REMOTE_PROTOCOL_INFO_BUFFER_SIZE);
+        try
+        {
+            for (int offset = 0; offset < REMOTE_PROTOCOL_INFO_BUFFER_SIZE; offset += 4)
+                Marshal.WriteInt32(buffer, offset, 0);
+            if (!GetFileInformationByHandleEx(
+                handle,
+                FILE_REMOTE_PROTOCOL_INFO_CLASS,
+                buffer,
+                REMOTE_PROTOCOL_INFO_BUFFER_SIZE))
+            {
+                int error = Marshal.GetLastWin32Error();
+                if (error == ERROR_INVALID_PARAMETER) return;
+                throw new Win32Exception(error);
+            }
+            int structureSize = (ushort)Marshal.ReadInt16(buffer, 2);
+            uint protocol = unchecked((uint)Marshal.ReadInt32(buffer, 4));
+            if (structureSize < 20
+                || structureSize > REMOTE_PROTOCOL_INFO_BUFFER_SIZE
+                || protocol != 0)
+            {
+                throw new UnauthorizedAccessException();
+            }
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(buffer);
+        }
+    }
+
+    private static string NormalizeHandlePath(string path)
+    {
+        if (path.StartsWith(@"\\?\UNC\", StringComparison.OrdinalIgnoreCase))
+            return @"\\" + path.Substring(8);
+        if (path.StartsWith(@"\\?\", StringComparison.OrdinalIgnoreCase))
+            return path.Substring(4);
+        return path;
+    }
+
+    private static void VerifyHandlePath(SafeFileHandle handle, string expectedPath)
+    {
+        StringBuilder buffer = new StringBuilder(32768);
+        uint length = GetFinalPathNameByHandleW(handle, buffer, (uint)buffer.Capacity, 0);
+        if (length == 0 || length >= buffer.Capacity)
+            throw new Win32Exception(Marshal.GetLastWin32Error());
+        string actual = Path.GetFullPath(NormalizeHandlePath(buffer.ToString()));
+        string expected = Path.GetFullPath(expectedPath);
+        if (!String.Equals(actual.TrimEnd('\\'), expected.TrimEnd('\\'),
+            StringComparison.OrdinalIgnoreCase))
+        {
+            throw new UnauthorizedAccessException();
+        }
+    }
+
+    private static SafeFileHandle OpenExisting(string target, bool directory, bool write)
+    {
+        uint access = GENERIC_READ | READ_CONTROL | WRITE_DAC | DELETE;
+        if (write) access |= GENERIC_WRITE;
+        uint flags = FILE_FLAG_OPEN_REPARSE_POINT;
+        if (directory) flags |= FILE_FLAG_BACKUP_SEMANTICS;
+        SafeFileHandle handle = CreateFileExisting(
+            target, access, 0, IntPtr.Zero, OPEN_EXISTING, flags, IntPtr.Zero);
+        if (handle.IsInvalid)
+        {
+            int error = Marshal.GetLastWin32Error();
+            handle.Dispose();
+            throw new Win32Exception(error);
+        }
+        return handle;
+    }
+
+    private static string NativePath(string target)
+    {
+        string full = Path.GetFullPath(target);
+        if (full.StartsWith(@"\\", StringComparison.Ordinal))
+            return @"\??\UNC\" + full.Substring(2);
+        return @"\??\" + full;
+    }
+
+    private static SafeFileHandle OpenOrCreateDirectory(
+        string target,
+        string userSid)
+    {
+        string nativePath = NativePath(target);
+        if (Encoding.Unicode.GetByteCount(nativePath) > UInt16.MaxValue - 2)
+            throw new PathTooLongException();
+
+        IntPtr nameBuffer = IntPtr.Zero;
+        IntPtr namePointer = IntPtr.Zero;
+        IntPtr descriptor = IntPtr.Zero;
+        IntPtr rawHandle = IntPtr.Zero;
+        try
+        {
+            nameBuffer = Marshal.StringToHGlobalUni(nativePath);
+            UnicodeString name = new UnicodeString();
+            name.Length = (ushort)Encoding.Unicode.GetByteCount(nativePath);
+            name.MaximumLength = (ushort)(name.Length + 2);
+            name.Buffer = nameBuffer;
+            namePointer = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UnicodeString)));
+            Marshal.StructureToPtr(name, namePointer, false);
+            descriptor = CreateExactDescriptor(userSid, true);
+
+            ObjectAttributes attributes = new ObjectAttributes();
+            attributes.Length = Marshal.SizeOf(typeof(ObjectAttributes));
+            attributes.ObjectName = namePointer;
+            attributes.Attributes = OBJ_CASE_INSENSITIVE;
+            attributes.SecurityDescriptor = descriptor;
+
+            IoStatusBlock ioStatus;
+            int status = NtCreateFile(
+                out rawHandle,
+                GENERIC_READ | READ_CONTROL | WRITE_DAC | DELETE | SYNCHRONIZE,
+                ref attributes,
+                out ioStatus,
+                IntPtr.Zero,
+                0,
+                0,
+                FILE_OPEN_IF,
+                FILE_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT | FILE_OPEN_REPARSE_POINT,
+                IntPtr.Zero,
+                0);
+            if (status < 0)
+                throw new Win32Exception((int)RtlNtStatusToDosError(status));
+            return new SafeFileHandle(rawHandle, true);
+        }
+        catch
+        {
+            if (rawHandle != IntPtr.Zero && rawHandle != new IntPtr(-1))
+                new SafeFileHandle(rawHandle, true).Dispose();
+            throw;
+        }
+        finally
+        {
+            if (descriptor != IntPtr.Zero) LocalFree(descriptor);
+            if (namePointer != IntPtr.Zero) Marshal.FreeHGlobal(namePointer);
+            if (nameBuffer != IntPtr.Zero) Marshal.FreeHGlobal(nameBuffer);
+        }
+    }
+
+    private static void EnsureParentDirectories(string target, string userSid)
+    {
+        string parent = Path.GetDirectoryName(Path.GetFullPath(target));
+        if (String.IsNullOrEmpty(parent) || Directory.Exists(parent)) return;
+        EnsurePrivateDirectory(parent, userSid);
+    }
+
+    public static void EnsurePrivateDirectory(string target, string userSid)
+    {
+        string fullTarget = Path.GetFullPath(target);
+        string root = Path.GetPathRoot(fullTarget);
+        if (String.Equals(fullTarget.TrimEnd('\\'), root.TrimEnd('\\'),
+            StringComparison.OrdinalIgnoreCase))
+            throw new UnauthorizedAccessException();
+        EnsureParentDirectories(fullTarget, userSid);
+        using (SafeFileHandle handle = OpenOrCreateDirectory(fullTarget, userSid))
+        {
+            ValidateHandle(handle, true);
+            VerifyHandlePath(handle, fullTarget);
+            HashSet<string> expectedSids = ExpectedSids(userSid);
+            string owner = ValidateOwner(handle, expectedSids);
+            SetExactDacl(handle, userSid, true);
+            VerifyExactDacl(handle, userSid, true, owner);
+            VerifyHandlePath(handle, fullTarget);
+        }
+    }
+
+    public static void HardenExisting(string target, string userSid, bool directory)
+    {
+        using (SafeFileHandle handle = OpenExisting(target, directory, false))
+        {
+            ValidateHandle(handle, directory);
+            VerifyHandlePath(handle, target);
+            HashSet<string> expectedSids = ExpectedSids(userSid);
+            string owner = ValidateOwner(handle, expectedSids);
+            SetExactDacl(handle, userSid, directory);
+            VerifyExactDacl(handle, userSid, directory, owner);
+            ValidateHandle(handle, directory);
+            VerifyHandlePath(handle, target);
+        }
+    }
+
+    private static bool IsReservedTreeName(string name)
+    {
+        string stem = name;
+        int dot = stem.IndexOf('.');
+        if (dot >= 0) stem = stem.Substring(0, dot);
+        stem = stem.ToUpperInvariant();
+        if (stem == "CON" || stem == "PRN" || stem == "AUX" || stem == "NUL"
+            || stem == "CONIN$" || stem == "CONOUT$") return true;
+        if (stem.Length == 4 && (stem.StartsWith("COM", StringComparison.Ordinal)
+            || stem.StartsWith("LPT", StringComparison.Ordinal)))
+        {
+            char suffix = stem[3];
+            return suffix >= '1' && suffix <= '9';
+        }
+        return false;
+    }
+
+    private static void ValidateTreeEntryName(string name)
+    {
+        if (String.IsNullOrEmpty(name) || name == "." || name == ".."
+            || name.EndsWith(".", StringComparison.Ordinal)
+            || name.EndsWith(" ", StringComparison.Ordinal)
+            || IsReservedTreeName(name))
+        {
+            throw new UnauthorizedAccessException();
+        }
+        foreach (char character in name)
+        {
+            if (character < 32 || character == ':' || character == '\\' || character == '/'
+                || character == '<' || character == '>' || character == '"'
+                || character == '|' || character == '?' || character == '*')
+            {
+                throw new UnauthorizedAccessException();
+            }
+        }
+    }
+
+    private static string ValidateTreeRootPath(string target)
+    {
+        if (String.IsNullOrEmpty(target) || target.Length > MAX_TREE_PATH_LENGTH
+            || target.Length < 3 || !Char.IsLetter(target[0]) || target[1] != ':'
+            || target[2] != '\\' || target.IndexOf('/') >= 0
+            || target.IndexOf(':', 2) >= 0)
+        {
+            throw new UnauthorizedAccessException();
+        }
+        string fullTarget = Path.GetFullPath(target);
+        if (!String.Equals(fullTarget, target, StringComparison.OrdinalIgnoreCase))
+            throw new UnauthorizedAccessException();
+        string root = Path.GetPathRoot(fullTarget);
+        if (String.Equals(fullTarget.TrimEnd('\\'), root.TrimEnd('\\'),
+            StringComparison.OrdinalIgnoreCase))
+        {
+            throw new UnauthorizedAccessException();
+        }
+        string relative = fullTarget.Substring(root.Length);
+        foreach (string segment in relative.Split(new char[] { '\\' }, StringSplitOptions.RemoveEmptyEntries))
+            ValidateTreeEntryName(segment);
+        return fullTarget;
+    }
+
+    private static string TreeChildPath(string root, string parent, string name)
+    {
+        ValidateTreeEntryName(name);
+        string child = Path.GetFullPath(Path.Combine(parent, name));
+        string prefix = root.TrimEnd('\\') + "\\";
+        if (child.Length > MAX_TREE_PATH_LENGTH
+            || !child.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)
+            || !String.Equals(Path.GetFileName(child), name, StringComparison.Ordinal))
+        {
+            throw new UnauthorizedAccessException();
+        }
+        return child;
+    }
+
+    private static List<TreeEntry> ReadDirectoryEntries(SafeFileHandle handle)
+    {
+        List<TreeEntry> entries = new List<TreeEntry>();
+        HashSet<string> names = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        IntPtr buffer = Marshal.AllocHGlobal(DIRECTORY_INFORMATION_BUFFER_SIZE);
+        try
+        {
+            bool restartScan = true;
+            while (true)
+            {
+                IoStatusBlock ioStatus;
+                int status = NtQueryDirectoryFile(
+                    handle,
+                    IntPtr.Zero,
+                    IntPtr.Zero,
+                    IntPtr.Zero,
+                    out ioStatus,
+                    buffer,
+                    DIRECTORY_INFORMATION_BUFFER_SIZE,
+                    FILE_ID_BOTH_DIRECTORY_INFORMATION_CLASS,
+                    true,
+                    IntPtr.Zero,
+                    restartScan);
+                restartScan = false;
+                if (status == STATUS_NO_MORE_FILES) break;
+                if (status != 0)
+                    throw new Win32Exception((int)RtlNtStatusToDosError(status));
+
+                ulong bytesReturned = ioStatus.Information.ToUInt64();
+                if (bytesReturned < DIRECTORY_INFORMATION_NAME_OFFSET
+                    || bytesReturned > DIRECTORY_INFORMATION_BUFFER_SIZE)
+                {
+                    throw new InvalidDataException();
+                }
+                int nameLength = Marshal.ReadInt32(buffer, 60);
+                if (nameLength < 0 || (nameLength & 1) != 0
+                    || (ulong)(DIRECTORY_INFORMATION_NAME_OFFSET + nameLength) > bytesReturned)
+                {
+                    throw new InvalidDataException();
+                }
+                string name = Marshal.PtrToStringUni(
+                    IntPtr.Add(buffer, DIRECTORY_INFORMATION_NAME_OFFSET),
+                    nameLength / 2);
+                if (name == "." || name == "..") continue;
+                ValidateTreeEntryName(name);
+                if (!names.Add(name)) throw new UnauthorizedAccessException();
+                TreeEntry entry = new TreeEntry();
+                entry.Name = name;
+                entry.Attributes = unchecked((uint)Marshal.ReadInt32(buffer, 56));
+                entry.FileId = unchecked((ulong)Marshal.ReadInt64(
+                    buffer,
+                    DIRECTORY_INFORMATION_FILE_ID_OFFSET));
+                if (entry.FileId == 0) throw new UnauthorizedAccessException();
+                entries.Add(entry);
+                if (entries.Count > MAX_TREE_ENTRIES)
+                    throw new UnauthorizedAccessException();
+            }
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(buffer);
+        }
+        entries.Sort(delegate(TreeEntry left, TreeEntry right)
+        {
+            int comparison = StringComparer.OrdinalIgnoreCase.Compare(left.Name, right.Name);
+            return comparison != 0 ? comparison : StringComparer.Ordinal.Compare(left.Name, right.Name);
+        });
+        return entries;
+    }
+
+    private static void VerifyUnchangedDirectoryEntries(
+        List<TreeEntry> expected,
+        List<TreeEntry> actual)
+    {
+        if (expected.Count != actual.Count) throw new UnauthorizedAccessException();
+        for (int index = 0; index < expected.Count; index++)
+        {
+            if (!String.Equals(expected[index].Name, actual[index].Name, StringComparison.Ordinal)
+                || expected[index].Attributes != actual[index].Attributes
+                || expected[index].FileId != actual[index].FileId)
+            {
+                throw new UnauthorizedAccessException();
+            }
+        }
+    }
+
+    private static string HardenTreeEntry(
+        SafeFileHandle handle,
+        string target,
+        string userSid,
+        bool directory,
+        HashSet<string> expectedSids)
+    {
+        ValidateHandle(handle, directory);
+        VerifyHandlePath(handle, target);
+        string owner = ValidateOwner(handle, expectedSids);
+        SetExactDacl(handle, userSid, directory);
+        VerifyExactDacl(handle, userSid, directory, owner);
+        ValidateHandle(handle, directory);
+        VerifyHandlePath(handle, target);
+        return owner;
+    }
+
+    private static void HardenTreeDirectory(
+        SafeFileHandle directoryHandle,
+        string root,
+        string directoryPath,
+        string userSid,
+        HashSet<string> expectedSids,
+        int depth,
+        ref int entryCount,
+        List<HeldTreeHandle> heldHandles)
+    {
+        if (depth > MAX_TREE_DEPTH) throw new UnauthorizedAccessException();
+        List<TreeEntry> snapshot = ReadDirectoryEntries(directoryHandle);
+        foreach (TreeEntry entry in snapshot)
+        {
+            entryCount++;
+            if (entryCount > MAX_TREE_ENTRIES) throw new UnauthorizedAccessException();
+            if ((entry.Attributes & (FILE_ATTRIBUTE_REPARSE_POINT | FILE_ATTRIBUTE_DEVICE)) != 0)
+                throw new UnauthorizedAccessException();
+            bool directory = (entry.Attributes & FILE_ATTRIBUTE_DIRECTORY) != 0;
+            string childPath = TreeChildPath(root, directoryPath, entry.Name);
+            SafeFileHandle childHandle = OpenExisting(childPath, directory, false);
+            try
+            {
+                HeldTreeHandle heldHandle = new HeldTreeHandle();
+                heldHandle.Handle = childHandle;
+                heldHandle.Path = childPath;
+                heldHandle.Directory = directory;
+                heldHandles.Add(heldHandle);
+            }
+            catch
+            {
+                childHandle.Dispose();
+                throw;
+            }
+            VerifyTreeHandleIdentity(childHandle, entry.FileId);
+            heldHandles[heldHandles.Count - 1].Owner = HardenTreeEntry(
+                childHandle,
+                childPath,
+                userSid,
+                directory,
+                expectedSids);
+            if (directory)
+            {
+                HardenTreeDirectory(
+                    childHandle,
+                    root,
+                    childPath,
+                    userSid,
+                    expectedSids,
+                    depth + 1,
+                    ref entryCount,
+                    heldHandles);
+            }
+        }
+        VerifyUnchangedDirectoryEntries(snapshot, ReadDirectoryEntries(directoryHandle));
+        ValidateHandle(directoryHandle, true);
+        VerifyHandlePath(directoryHandle, directoryPath);
+    }
+
+    public static void HardenTree(string target, string userSid)
+    {
+        string root = ValidateTreeRootPath(target);
+        HashSet<string> expectedSids = ExpectedSids(userSid);
+        List<HeldTreeHandle> heldHandles = new List<HeldTreeHandle>();
+        try
+        {
+            SafeFileHandle rootHandle = OpenExisting(root, true, false);
+            HeldTreeHandle heldRoot = new HeldTreeHandle();
+            heldRoot.Handle = rootHandle;
+            heldRoot.Path = root;
+            heldRoot.Directory = true;
+            heldHandles.Add(heldRoot);
+            heldRoot.Owner = HardenTreeEntry(rootHandle, root, userSid, true, expectedSids);
+            int entryCount = 1;
+            HardenTreeDirectory(
+                rootHandle,
+                root,
+                root,
+                userSid,
+                expectedSids,
+                0,
+                ref entryCount,
+                heldHandles);
+            foreach (HeldTreeHandle heldHandle in heldHandles)
+            {
+                ValidateHandle(heldHandle.Handle, heldHandle.Directory);
+                VerifyExactDacl(
+                    heldHandle.Handle,
+                    userSid,
+                    heldHandle.Directory,
+                    heldHandle.Owner);
+                VerifyHandlePath(heldHandle.Handle, heldHandle.Path);
+            }
+        }
+        finally
+        {
+            for (int index = heldHandles.Count - 1; index >= 0; index--)
+                heldHandles[index].Handle.Dispose();
+        }
+    }
+
+    private static bool SetDeletePending(SafeFileHandle handle, bool deleteFile)
+    {
+        FileDispositionInfo information = new FileDispositionInfo();
+        information.DeleteFile = deleteFile;
+        return SetFileInformationByHandle(
+            handle,
+            FILE_DISPOSITION_INFO_CLASS,
+            ref information,
+            (uint)Marshal.SizeOf(typeof(FileDispositionInfo)));
+    }
+
+    private static SafeFileHandle OpenForWrite(string target, string userSid)
+    {
+        IntPtr descriptor = CreateExactDescriptor(userSid, false);
+        try
+        {
+            SecurityAttributes attributes = new SecurityAttributes();
+            attributes.Length = Marshal.SizeOf(typeof(SecurityAttributes));
+            attributes.SecurityDescriptor = descriptor;
+            attributes.InheritHandle = false;
+            SafeFileHandle handle = CreateFileNew(
+                target,
+                GENERIC_READ | GENERIC_WRITE | READ_CONTROL | WRITE_DAC | DELETE,
+                0,
+                ref attributes,
+                CREATE_NEW,
+                FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT,
+                IntPtr.Zero);
+            if (!handle.IsInvalid) return handle;
+
+            int error = Marshal.GetLastWin32Error();
+            handle.Dispose();
+            throw new Win32Exception(error);
+        }
+        finally
+        {
+            LocalFree(descriptor);
+        }
+    }
 
-  if (platform !== 'win32') {
-    fsImpl.chmodSync(targetPath, mode);
+    private static int FrameLength(byte[] frame)
+    {
+        if (frame == null || frame.Length < 8) throw new InvalidDataException();
+        ulong length = BitConverter.ToUInt64(frame, 0);
+        if (length > Int32.MaxValue || length != (ulong)(frame.Length - 8))
+            throw new InvalidDataException();
+        return (int)length;
+    }
+
+    public static void WritePrivateFile(string target, string userSid, byte[] frame)
+    {
+        int contentLength = FrameLength(frame);
+        SafeFileHandle handle = OpenForWrite(target, userSid);
+        FileStream stream = null;
+        bool deletePending = false;
+        try
+        {
+            ValidateHandle(handle, false);
+            VerifyHandlePath(handle, target);
+            if (!SetDeletePending(handle, true))
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            deletePending = true;
+            HashSet<string> expectedSids = ExpectedSids(userSid);
+            string owner = ValidateOwner(handle, expectedSids);
+            SetExactDacl(handle, userSid, false);
+            VerifyExactDacl(handle, userSid, false, owner);
+
+            stream = new FileStream(handle, FileAccess.ReadWrite);
+            stream.SetLength(0);
+            stream.Write(frame, 8, contentLength);
+            stream.Flush(true);
+            VerifyFreshFileState(handle, true, false);
+            VerifyExactDacl(handle, userSid, false, owner);
+            VerifyHandlePath(handle, target);
+            if (!SetDeletePending(handle, false))
+                throw new Win32Exception(Marshal.GetLastWin32Error());
+            deletePending = false;
+            ValidateHandle(handle, false);
+            VerifyHandlePath(handle, target);
+        }
+        catch
+        {
+            try
+            {
+                if (stream != null)
+                {
+                    stream.SetLength(0);
+                    stream.Flush(true);
+                }
+            }
+            catch {}
+            if (!deletePending)
+            {
+                try { deletePending = SetDeletePending(handle, true); }
+                catch { deletePending = false; }
+            }
+            throw;
+        }
+        finally
+        {
+            Array.Clear(frame, 0, frame.Length);
+            if (stream != null) stream.Dispose();
+            else handle.Dispose();
+        }
+    }
+}`;
+
+const WINDOWS_ACL_CSHARP_GZIP = gzipSync(
+  Buffer.from(WINDOWS_ACL_CSHARP),
+  { level: 9 },
+).toString('base64');
+
+const WINDOWS_ACL_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  "$ProgressPreference = 'SilentlyContinue'",
+  'try {',
+  'Set-StrictMode -Version 3',
+  "$target=[Environment]::GetEnvironmentVariable('BLUN_PRIVATE_ACL_TARGET','Process')",
+  "$kind=[Environment]::GetEnvironmentVariable('BLUN_PRIVATE_ACL_KIND','Process')",
+  "$sid=[Environment]::GetEnvironmentVariable('BLUN_PRIVATE_ACL_USER_SID','Process')",
+  "if ([string]::IsNullOrWhiteSpace($target) -or -not [IO.Path]::IsPathRooted($target)) { throw 'Invalid target.' }",
+  "if ($kind -ne 'directory' -and $kind -ne 'file' -and $kind -ne 'file-write' -and $kind -ne 'tree') { throw 'Invalid kind.' }",
+  `$bytes=[Convert]::FromBase64String('${WINDOWS_ACL_CSHARP_GZIP}')`,
+  '$zipin=[IO.MemoryStream]::new($bytes)',
+  '$gzip=[IO.Compression.GZipStream]::new($zipin,[IO.Compression.CompressionMode]::Decompress)',
+  '$reader=[IO.StreamReader]::new($gzip,[Text.Encoding]::UTF8)',
+  'try {',
+  '$code=$reader.ReadToEnd()',
+  '} finally {',
+  '$reader.Dispose()',
+  '$gzip.Dispose()',
+  '$zipin.Dispose()',
+  '[Array]::Clear($bytes,0,$bytes.Length)',
+  '}',
+  '$null=Add-Type -TypeDefinition $code -Language CSharp',
+  "if ($kind -eq 'directory') {",
+  '[BlunPrivateAclNative]::EnsurePrivateDirectory($target,$sid)',
+  "} elseif ($kind -eq 'file') {",
+  '[BlunPrivateAclNative]::HardenExisting($target,$sid,$false)',
+  "} elseif ($kind -eq 'tree') {",
+  '[BlunPrivateAclNative]::HardenTree($target,$sid)',
+  '} else {',
+  '$stdin=[Console]::OpenStandardInput()',
+  '$mem=[IO.MemoryStream]::new()',
+  '$frame=$null',
+  'try {',
+  '$stdin.CopyTo($mem)',
+  '$frame=$mem.ToArray()',
+  '[BlunPrivateAclNative]::WritePrivateFile($target,$sid,$frame)',
+  '} finally {',
+  'if ($null -ne $frame) { [Array]::Clear($frame,0,$frame.Length) }',
+  '$mem.Dispose()',
+  '}',
+  '}',
+  "[Console]::Out.Write('BLUN_PRIVATE_ACL_OK_V1')",
+  'exit 0',
+  '} catch {',
+  "[Console]::Error.Write('BLUN_PRIVATE_ACL_ERROR_V1')",
+  'exit 1',
+  '}',
+].join('\n');
+
+const WINDOWS_ACL_ENCODED_COMMAND = Buffer.from(WINDOWS_ACL_SCRIPT, 'utf16le').toString('base64');
+
+function windowsSystemDirectory(options) {
+  const env = options.env || process.env;
+  const systemRoot = env.SystemRoot || env.SYSTEMROOT || env.WINDIR || env.windir;
+  const directory = options.systemDirectory
+    || (systemRoot ? path.win32.join(systemRoot, 'System32') : '');
+  if (!path.win32.isAbsolute(directory)
+    || path.win32.basename(directory).toLowerCase() !== 'system32') {
+    throw new Error('Cannot resolve the absolute Windows system directory for private ACLs.');
+  }
+  return path.win32.normalize(directory);
+}
+
+function windowsHostEnvironment(systemDirectory) {
+  const systemRoot = path.win32.dirname(systemDirectory);
+  return { SystemRoot: systemRoot, WINDIR: systemRoot };
+}
+
+function runWindowsCommand(executable, args, options, env, input) {
+  const execFileSyncImpl = options.execFileSyncImpl || execFileSync;
+  const hasInput = input !== undefined;
+  return execFileSyncImpl(executable, [...args], {
+    encoding: 'utf8',
+    env,
+    input,
+    maxBuffer: 64 * 1024,
+    shell: false,
+    stdio: [hasInput ? 'pipe' : 'ignore', 'pipe', 'pipe'],
+    timeout: 30_000,
+    windowsHide: true,
+  });
+}
+
+function framedPrivateContents(contents) {
+  const payload = Buffer.isBuffer(contents) ? Buffer.from(contents) : Buffer.from(String(contents));
+  let frame;
+  try {
+    frame = Buffer.allocUnsafe(8 + payload.length);
+    frame.writeBigUInt64LE(BigInt(payload.length), 0);
+    payload.copy(frame, 8);
+    return frame;
+  } catch (error) {
+    frame?.fill(0);
+    throw error;
+  } finally {
+    payload.fill(0);
+  }
+}
+
+function resolveWindowsPrivateTarget(targetPath) {
+  if (process.platform !== 'win32') return path.resolve(targetPath);
+  try {
+    if (typeof targetPath !== 'string'
+      || !WINDOWS_LOCAL_DOS_PATH_PATTERN.test(targetPath)
+      || !path.win32.isAbsolute(targetPath)
+      || targetPath.includes('/')
+      || targetPath.slice(2).includes(':')) {
+      throw new Error('Invalid Windows private path.');
+    }
+    const normalizedTarget = path.win32.normalize(targetPath);
+    if (normalizedTarget.toLowerCase() !== targetPath.toLowerCase()) {
+      throw new Error('Invalid Windows private path.');
+    }
+    const segments = normalizedTarget.slice(3).split('\\').filter(Boolean);
+    if (segments.some((segment) => segment.endsWith('.')
+      || segment.endsWith(' ')
+      || /[\u0000-\u001F<>"|?*]/u.test(segment)
+      || WINDOWS_RESERVED_PATH_SEGMENT.test(segment))) {
+      throw new Error('Invalid Windows private path.');
+    }
+    const absoluteTarget = path.resolve(normalizedTarget);
+    if (!WINDOWS_LOCAL_DOS_PATH_PATTERN.test(absoluteTarget)
+      || absoluteTarget.slice(2).includes(':')) {
+      throw new Error('Invalid Windows private path.');
+    }
+    return absoluteTarget;
+  } catch {
+    throw new Error('Windows private ACL hardening or verification failed.');
+  }
+}
+
+function windowsAclController(options) {
+  const systemDirectory = windowsSystemDirectory(options);
+  const hostEnvironment = windowsHostEnvironment(systemDirectory);
+  const whoami = path.win32.join(systemDirectory, 'whoami.exe');
+  const powershell = path.win32.join(
+    systemDirectory,
+    'WindowsPowerShell',
+    'v1.0',
+    'powershell.exe',
+  );
+  let userSid;
+
+  const currentUserSid = () => {
+    if (userSid !== undefined) return userSid;
+    let output;
+    try {
+      output = runWindowsCommand(
+        whoami,
+        ['/user', '/fo', 'csv', '/nh'],
+        options,
+        hostEnvironment,
+      );
+    } catch {
+      throw new Error('Cannot determine the current Windows user SID for private launcher paths.');
+    }
+    const sids = [...new Set(String(output).match(WINDOWS_SID_PATTERN) || [])];
+    if (sids.length !== 1) {
+      throw new Error('Cannot determine the current Windows user SID for private launcher paths.');
+    }
+    userSid = sids[0].toUpperCase();
+    return userSid;
+  };
+
+  const invoke = (targetPath, kind, input) => {
+    try {
+      const absoluteTarget = resolveWindowsPrivateTarget(targetPath);
+      const root = path.parse(absoluteTarget).root;
+      if (!path.isAbsolute(absoluteTarget)
+        || root.toLowerCase() === absoluteTarget.toLowerCase()
+        || !['directory', 'file', 'file-write', 'tree'].includes(kind)) {
+        throw new Error('Windows private ACL hardening or verification failed.');
+      }
+      const env = {
+        ...hostEnvironment,
+        BLUN_PRIVATE_ACL_KIND: kind,
+        BLUN_PRIVATE_ACL_TARGET: absoluteTarget,
+        BLUN_PRIVATE_ACL_USER_SID: currentUserSid(),
+      };
+      let output;
+      try {
+        output = runWindowsCommand(
+          powershell,
+          ['-NoLogo', '-NoProfile', '-NonInteractive', '-EncodedCommand',
+            WINDOWS_ACL_ENCODED_COMMAND],
+          options,
+          env,
+          input,
+        );
+      } catch {
+        throw new Error('Windows private ACL hardening or verification failed.');
+      }
+      if (output !== WINDOWS_ACL_OK_SENTINEL) {
+        throw new Error('Windows private ACL hardening or verification failed.');
+      }
+    } finally {
+      input?.fill(0);
+    }
+  };
+
+  return {
+    hardenAndVerify(targetPath, kind) {
+      invoke(targetPath, kind);
+    },
+    hardenTree(targetPath) {
+      invoke(targetPath, 'tree');
+    },
+    writeAndVerify(targetPath, contents) {
+      invoke(targetPath, 'file-write', framedPrivateContents(contents));
+    },
+  };
+}
+
+function sameFileIdentity(left, right) {
+  return left !== undefined
+    && right !== undefined
+    && left.dev !== undefined
+    && left.ino !== undefined
+    && left.dev === right.dev
+    && left.ino === right.ino;
+}
+
+function validatePosixEntry(stat, directory) {
+  if (stat.isSymbolicLink()
+    || stat.isDirectory() !== directory
+    || stat.isFile() === directory
+    || (!directory && stat.nlink !== 1)) {
+    throw new Error('Unsafe private path entry.');
+  }
+  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
+    throw new Error('Unsafe private path owner.');
+  }
+}
+
+function verifyPosixHandlePath(targetPath, descriptor, identity, directory, fsImpl) {
+  const byHandle = fsImpl.fstatSync(descriptor);
+  const byPath = fsImpl.lstatSync(targetPath);
+  validatePosixEntry(byHandle, directory);
+  validatePosixEntry(byPath, directory);
+  if (!sameFileIdentity(identity, byHandle)
+    || !sameFileIdentity(byHandle, byPath)) {
+    throw new Error('Private path identity changed.');
+  }
+  return byHandle;
+}
+
+function openVerifiedPosixEntry(targetPath, fsImpl, requireDirectory = false) {
+  const before = fsImpl.lstatSync(targetPath);
+  const directory = before.isDirectory();
+  validatePosixEntry(before, directory);
+  if (requireDirectory && !directory) throw new Error('Private path is not a directory.');
+
+  const noFollow = fs.constants.O_NOFOLLOW || 0;
+  const directoryOnly = directory ? (fs.constants.O_DIRECTORY || 0) : 0;
+  let descriptor;
+  try {
+    descriptor = fsImpl.openSync(
+      targetPath,
+      fs.constants.O_RDONLY | noFollow | directoryOnly,
+    );
+    verifyPosixHandlePath(targetPath, descriptor, before, directory, fsImpl);
+    return { descriptor, directory, identity: before };
+  } catch (error) {
+    if (descriptor !== undefined) {
+      try {
+        fsImpl.closeSync(descriptor);
+      } catch {
+        // Preserve the verification failure.
+      }
+    }
+    throw error;
+  }
+}
+
+function applyPosixModeByHandle(
+  targetPath,
+  descriptor,
+  identity,
+  directory,
+  mode,
+  fsImpl,
+  options,
+) {
+  verifyPosixHandlePath(targetPath, descriptor, identity, directory, fsImpl);
+  const emulatingPosixOnWindows = process.platform === 'win32'
+    && options.platform !== 'win32';
+  if (!emulatingPosixOnWindows) fsImpl.fchmodSync(descriptor, mode);
+  const hardened = verifyPosixHandlePath(
+    targetPath,
+    descriptor,
+    identity,
+    directory,
+    fsImpl,
+  );
+  if (!emulatingPosixOnWindows && (hardened.mode & 0o777) !== mode) {
+    throw new Error('Private path mode verification failed.');
   }
 }
 
 function ensurePrivateDirectory(targetPath, options = {}) {
   const fsImpl = options.fsImpl || fs;
-  fsImpl.mkdirSync(targetPath, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
-  applyPosixMode(targetPath, PRIVATE_DIRECTORY_MODE, options);
+  const platform = options.platform || process.platform;
+  if (platform === 'win32') {
+    windowsAclController(options).hardenAndVerify(targetPath, 'directory');
+    return;
+  }
+
+  const absoluteTarget = path.resolve(targetPath);
+  let opened;
+  try {
+    fsImpl.mkdirSync(absoluteTarget, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+    opened = openVerifiedPosixEntry(absoluteTarget, fsImpl, true);
+    applyPosixModeByHandle(
+      absoluteTarget,
+      opened.descriptor,
+      opened.identity,
+      true,
+      PRIVATE_DIRECTORY_MODE,
+      fsImpl,
+      options,
+    );
+  } catch {
+    throw new Error('Private directory hardening or verification failed.');
+  } finally {
+    if (opened !== undefined) fsImpl.closeSync(opened.descriptor);
+  }
+}
+
+function scrubCreatedPosixFile(targetPath, descriptor, identity, fsImpl) {
+  try {
+    fsImpl.ftruncateSync(descriptor, 0);
+    fsImpl.fsyncSync(descriptor);
+  } catch {
+    // Continue with identity-bound removal even if scrubbing was incomplete.
+  }
+  try {
+    const byHandle = fsImpl.fstatSync(descriptor);
+    const byPath = fsImpl.lstatSync(targetPath);
+    if (sameFileIdentity(identity, byHandle)
+      && sameFileIdentity(byHandle, byPath)
+      && !byPath.isSymbolicLink()
+      && byPath.isFile()) {
+      fsImpl.unlinkSync(targetPath);
+    }
+  } catch {
+    // Never delete a pathname whose identity cannot be proven.
+  }
 }
 
 function writePrivateFile(targetPath, contents, options = {}) {
   const fsImpl = options.fsImpl || fs;
-  fsImpl.writeFileSync(targetPath, contents, { mode: PRIVATE_FILE_MODE });
-  applyPosixMode(targetPath, PRIVATE_FILE_MODE, options);
+  const platform = options.platform || process.platform;
+  if (platform === 'win32') {
+    windowsAclController(options).writeAndVerify(targetPath, contents);
+    return;
+  }
+
+  const absoluteTarget = path.resolve(targetPath);
+  const payload = Buffer.isBuffer(contents) ? Buffer.from(contents) : Buffer.from(String(contents));
+  let descriptor;
+  let identity;
+  let completed = false;
+  try {
+    const noFollow = fs.constants.O_NOFOLLOW || 0;
+    descriptor = fsImpl.openSync(
+      absoluteTarget,
+      fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | noFollow,
+      PRIVATE_FILE_MODE,
+    );
+    identity = fsImpl.fstatSync(descriptor);
+    validatePosixEntry(identity, false);
+    if (identity.size > 0) throw new Error('New private file is not empty.');
+    verifyPosixHandlePath(absoluteTarget, descriptor, identity, false, fsImpl);
+    applyPosixModeByHandle(
+      absoluteTarget,
+      descriptor,
+      identity,
+      false,
+      PRIVATE_FILE_MODE,
+      fsImpl,
+      options,
+    );
+    fsImpl.writeFileSync(descriptor, payload);
+    fsImpl.fsyncSync(descriptor);
+    verifyPosixHandlePath(absoluteTarget, descriptor, identity, false, fsImpl);
+    completed = true;
+  } catch {
+    throw new Error('Private file hardening or verification failed.');
+  } finally {
+    if (descriptor !== undefined) {
+      if (!completed && identity !== undefined) {
+        scrubCreatedPosixFile(absoluteTarget, descriptor, identity, fsImpl);
+      }
+      try {
+        fsImpl.closeSync(descriptor);
+      } catch {
+        completed = false;
+      }
+    }
+    payload.fill(0);
+  }
+  if (!completed) throw new Error('Private file hardening or verification failed.');
 }
 
 function securePrivateFile(targetPath, options = {}) {
-  applyPosixMode(targetPath, PRIVATE_FILE_MODE, options);
+  const fsImpl = options.fsImpl || fs;
+  const platform = options.platform || process.platform;
+  if (platform === 'win32') {
+    windowsAclController(options).hardenAndVerify(targetPath, 'file');
+    return;
+  }
+
+  const absoluteTarget = path.resolve(targetPath);
+  let opened;
+  try {
+    opened = openVerifiedPosixEntry(absoluteTarget, fsImpl);
+    if (opened.directory) throw new Error('Private path is not a file.');
+    applyPosixModeByHandle(
+      absoluteTarget,
+      opened.descriptor,
+      opened.identity,
+      false,
+      PRIVATE_FILE_MODE,
+      fsImpl,
+      options,
+    );
+  } catch {
+    throw new Error('Private file hardening or verification failed.');
+  } finally {
+    if (opened !== undefined) fsImpl.closeSync(opened.descriptor);
+  }
+}
+
+function securePosixPrivateTree(targetPath, fsImpl, options) {
+  const root = path.resolve(targetPath);
+  let entryCount = 0;
+
+  const visit = (currentPath, depth, rootEntry, parent) => {
+    if (depth > PRIVATE_TREE_MAX_DEPTH
+      || currentPath.length > PRIVATE_TREE_MAX_PATH_LENGTH
+      || ++entryCount > PRIVATE_TREE_MAX_ENTRIES) {
+      throw new Error('Private tree hardening or verification failed.');
+    }
+    const opened = openVerifiedPosixEntry(currentPath, fsImpl, rootEntry);
+    try {
+      if (parent !== undefined) {
+        verifyPosixHandlePath(
+          parent.path,
+          parent.descriptor,
+          parent.identity,
+          true,
+          fsImpl,
+        );
+      }
+      applyPosixModeByHandle(
+        currentPath,
+        opened.descriptor,
+        opened.identity,
+        opened.directory,
+        opened.directory ? PRIVATE_DIRECTORY_MODE : PRIVATE_FILE_MODE,
+        fsImpl,
+        options,
+      );
+
+      if (opened.directory) {
+        verifyPosixHandlePath(
+          currentPath,
+          opened.descriptor,
+          opened.identity,
+          true,
+          fsImpl,
+        );
+        const names = fsImpl.readdirSync(currentPath).toSorted();
+        verifyPosixHandlePath(
+          currentPath,
+          opened.descriptor,
+          opened.identity,
+          true,
+          fsImpl,
+        );
+        for (const name of names) {
+          if (name === '.' || name === '..' || name.includes('/') || name.includes('\\')) {
+            throw new Error('Private tree hardening or verification failed.');
+          }
+          verifyPosixHandlePath(
+            currentPath,
+            opened.descriptor,
+            opened.identity,
+            true,
+            fsImpl,
+          );
+          visit(path.join(currentPath, name), depth + 1, false, {
+            descriptor: opened.descriptor,
+            identity: opened.identity,
+            path: currentPath,
+          });
+        }
+        const afterNames = fsImpl.readdirSync(currentPath).toSorted();
+        if (names.length !== afterNames.length
+          || names.some((name, index) => name !== afterNames[index])) {
+          throw new Error('Private tree hardening or verification failed.');
+        }
+      }
+      verifyPosixHandlePath(
+        currentPath,
+        opened.descriptor,
+        opened.identity,
+        opened.directory,
+        fsImpl,
+      );
+    } finally {
+      fsImpl.closeSync(opened.descriptor);
+    }
+  };
+
+  try {
+    visit(root, 0, true);
+  } catch {
+    throw new Error('Private tree hardening or verification failed.');
+  }
+}
+
+function securePrivateTree(targetPath, options = {}) {
+  const fsImpl = options.fsImpl || fs;
+  const platform = options.platform || process.platform;
+  if (platform === 'win32') {
+    windowsAclController(options).hardenTree(targetPath);
+    return;
+  }
+  securePosixPrivateTree(targetPath, fsImpl, options);
 }
 
 module.exports = {
@@ -35,5 +1601,6 @@ module.exports = {
   PRIVATE_FILE_MODE,
   ensurePrivateDirectory,
   securePrivateFile,
+  securePrivateTree,
   writePrivateFile,
 };