Module watcher

Hot-reload watcher for policy files.

Wraps the notify crate to provide a debounced stream of filesystem events under a watched directory. The caller drains events via PolicyWatcher::events and decides what to do (typically call PolicyStore::load_policies to re-read the disk state).

Debouncing

A single editor save can produce 3-5 raw events (modify → close-write → chmod → …). The watcher coalesces events that arrive within debounce of each other into a single batch. The kind is collapsed to the dominant kind for the batch (Create wins, then Write, then Remove, then Other).

Errors

watch() returns an error if the underlying watcher cannot register the store (for example, because it does not exist or is unreadable). Runtime errors delivered by notify are available through PolicyWatcher::take_errors; an empty events() result is normal and does not indicate watcher failure.

Structs

PolicyWatcher

A debounced filesystem watcher.

WatchEvent

A debounced filesystem event for a watched policy directory.

Enums

WatchEventKind

High-level event kind. Maps roughly to notify::EventKind but collapses the noisy variants (e.g. Modify::Metadata vs Modify::Data) into one actionable case.

Functions

watch

Watch a policy store for changes to Cedar files anywhere under policies/ and to schema.cedarschema. The returned watcher is debounced: events that arrive within debounce of each other are coalesced into a single batch.