@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/dist/lib/work-context/prd-sync.d.ts

@@ -1,56 +0,0 @@
-/**
- * US-040 / F14: diff a bound project's prd.json and describe task_status events.
- * A same-company PRD for a different project is a project switch (rebindTo).
- * A PRD in another company is skipped. Planning never touches the network.
- * The snapshot is written only after the caller accepts the plan (commit),
- * so a failed emit can retry.
- */
-import { type SessionStateFile } from "./state.js";
-export interface PrdStatusEvent {
-    taskId: string;
-    status: "done" | "in_progress" | "review";
-}
-export interface PrdSnapshot {
-    stories: Record<string, {
-        passes: boolean;
-        status?: string;
-    }>;
-    seq: number;
-    /** Project the snapshot belongs to. A switch starts a fresh story set. */
-    projectId?: string;
-}
-export declare function prdSnapshotPath(sessionId: string, root: string): string;
-export declare function readPrdSnapshot(sessionId: string, root: string): PrdSnapshot | null;
-/** `companies/<slug>/projects/<projectId>/prd.json` — nowhere else. */
-export declare function prdPathIdentity(file: string): {
-    companySlug: string;
-    projectId: string;
-} | null;
-export declare function prdBelongsToProject(file: string, projectId: string, companySlug: string | undefined): boolean;
-export declare function rebindSessionToProject(input: {
-    sessionId: string;
-    root: string;
-    projectId: string;
-    now?: () => Date;
-}): SessionStateFile | null;
-export interface PrdSyncPlan {
-    changed: boolean;
-    skip?: "no_state" | "not_bound" | "different_project" | "unreadable";
-    events: PrdStatusEvent[];
-    /** Same-company project the session should switch to before emit. */
-    rebindTo?: string;
-    /** Story most recently moved to in_progress, if any. */
-    taskId?: string;
-    seqStart: number;
-    /**
-     * Write the snapshot. With no argument, every planned story is recorded.
-     * With ids, only those stories advance; the rest stay changed for a retry.
-     */
-    commit: (acceptedTaskIds?: readonly string[]) => void;
-}
-export declare function planPrdSync(input: {
-    sessionId: string;
-    file: string;
-    root: string;
-}): PrdSyncPlan;
-//# sourceMappingURL=prd-sync.d.ts.map

package/dist/lib/work-context/prd-sync.js

@@ -1,197 +0,0 @@
-/**
- * US-040 / F14: diff a bound project's prd.json and describe task_status events.
- * A same-company PRD for a different project is a project switch (rebindTo).
- * A PRD in another company is skipped. Planning never touches the network.
- * The snapshot is written only after the caller accepts the plan (commit),
- * so a failed emit can retry.
- */
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { readSessionState, updateSessionState } from "./state.js";
-import { mapReaderStoryStatus } from "../mesh/story-status.js";
-export function prdSnapshotPath(sessionId, root) {
-    return path.join(root, "sessions", `${sessionId}.prd-snapshot.json`);
-}
-export function readPrdSnapshot(sessionId, root) {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(prdSnapshotPath(sessionId, root), "utf8"));
-        if (!parsed || typeof parsed !== "object" || !parsed.stories)
-            return null;
-        return {
-            stories: parsed.stories,
-            seq: typeof parsed.seq === "number" ? parsed.seq : 0,
-            ...(typeof parsed.projectId === "string" && parsed.projectId.trim()
-                ? { projectId: parsed.projectId.trim() }
-                : {}),
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/** `companies/<slug>/projects/<projectId>/prd.json` — nowhere else. */
-export function prdPathIdentity(file) {
-    const parts = path.resolve(file).split(path.sep);
-    if (parts[parts.length - 1] !== "prd.json")
-        return null;
-    const projectsAt = parts.lastIndexOf("projects");
-    if (projectsAt < 2 || parts[projectsAt - 2] !== "companies" || parts.length !== projectsAt + 3) {
-        return null;
-    }
-    const companySlug = parts[projectsAt - 1];
-    const projectId = parts[projectsAt + 1];
-    if (!companySlug || !projectId)
-        return null;
-    return { companySlug, projectId };
-}
-function writeSnapshot(sessionId, root, snapshot) {
-    const dest = prdSnapshotPath(sessionId, root);
-    fs.mkdirSync(path.dirname(dest), { recursive: true });
-    fs.writeFileSync(dest, `${JSON.stringify(snapshot)}\n`, { mode: 0o600 });
-}
-export function prdBelongsToProject(file, projectId, companySlug) {
-    if (!companySlug)
-        return false;
-    const identity = prdPathIdentity(file);
-    return Boolean(identity &&
-        identity.companySlug.toLowerCase() === companySlug.toLowerCase() &&
-        identity.projectId === projectId);
-}
-export function rebindSessionToProject(input) {
-    const nowIso = (input.now ?? (() => new Date()))().toISOString();
-    return updateSessionState(input.sessionId, input.root, (current) => {
-        if (!current)
-            return null;
-        if (current.projectId === input.projectId)
-            return current;
-        return {
-            ...current,
-            projectId: input.projectId,
-            taskId: undefined,
-            contextStatus: current.contextStatus === "bound" || current.contextStatus === "needs_task"
-                ? "needs_task"
-                : current.contextStatus,
-            projectBindReason: `prd-sync project switch to ${input.projectId}`,
-            updatedAt: nowIso,
-        };
-    });
-}
-function storiesFromPrd(file) {
-    const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
-    const rows = Array.isArray(parsed.userStories) ? parsed.userStories
-        : Array.isArray(parsed.stories) ? parsed.stories
-            : [];
-    const out = [];
-    for (const row of rows) {
-        if (!row || typeof row !== "object")
-            continue;
-        const id = row.id;
-        if (typeof id !== "string" || !id.trim())
-            continue;
-        const rawStatus = mapReaderStoryStatus(row);
-        const status = rawStatus?.trim() ? rawStatus.trim() : undefined;
-        out.push({
-            id: id.trim(),
-            passes: row.passes === true,
-            ...(status ? { status } : {}),
-        });
-    }
-    return out;
-}
-export function planPrdSync(input) {
-    const empty = (skip) => ({
-        changed: false,
-        skip,
-        events: [],
-        seqStart: 0,
-        commit: () => { },
-    });
-    let state;
-    try {
-        state = readSessionState(input.sessionId, input.root);
-    }
-    catch {
-        return empty("unreadable");
-    }
-    if (!state)
-        return empty("no_state");
-    if (!state.projectId || (state.contextStatus !== "bound" && state.contextStatus !== "needs_task")) {
-        return empty("not_bound");
-    }
-    const identity = prdPathIdentity(input.file);
-    if (!identity || !state.companySlug)
-        return empty("different_project");
-    if (identity.companySlug.toLowerCase() !== state.companySlug.toLowerCase()) {
-        return empty("different_project");
-    }
-    const targetProjectId = identity.projectId;
-    const rebindTo = state.projectId !== targetProjectId ? targetProjectId : undefined;
-    let stories;
-    try {
-        stories = storiesFromPrd(input.file);
-    }
-    catch {
-        return empty("unreadable");
-    }
-    const previousRaw = readPrdSnapshot(input.sessionId, input.root);
-    const previousProject = previousRaw?.projectId ?? state.projectId;
-    const previous = previousProject === targetProjectId ? previousRaw : null;
-    const before = previous?.stories ?? {};
-    const events = [];
-    let taskId;
-    const nextStories = {};
-    for (const story of stories) {
-        nextStories[story.id] = {
-            passes: story.passes,
-            ...(story.status ? { status: story.status } : {}),
-        };
-        const prior = previous ? before[story.id] : undefined;
-        if ((story.passes || story.status === "done") && !prior?.passes && prior?.status !== "done") {
-            events.push({ taskId: story.id, status: "done" });
-            continue;
-        }
-        if (story.status === "in_progress" && prior?.status !== "in_progress") {
-            events.push({ taskId: story.id, status: "in_progress" });
-            taskId = story.id;
-        }
-        if (story.status === "review" && prior?.status !== "review") {
-            events.push({ taskId: story.id, status: "review" });
-        }
-    }
-    const snapshot = {
-        stories: nextStories,
-        seq: (previous?.seq ?? 0) + events.length,
-        projectId: targetProjectId,
-    };
-    return {
-        changed: events.length > 0,
-        events,
-        ...(rebindTo ? { rebindTo } : {}),
-        ...(taskId ? { taskId } : {}),
-        seqStart: previous?.seq ?? 0,
-        commit: (acceptedTaskIds) => {
-            if (!acceptedTaskIds) {
-                writeSnapshot(input.sessionId, input.root, snapshot);
-                return;
-            }
-            const accepted = new Set(acceptedTaskIds);
-            const stories = { ...(previous?.stories ?? {}) };
-            let advanced = 0;
-            for (const event of events) {
-                if (!accepted.has(event.taskId))
-                    continue;
-                const next = nextStories[event.taskId];
-                if (!next)
-                    continue;
-                stories[event.taskId] = next;
-                advanced += 1;
-            }
-            writeSnapshot(input.sessionId, input.root, {
-                stories,
-                seq: (previous?.seq ?? 0) + advanced,
-                projectId: targetProjectId,
-            });
-        },
-    };
-}
-//# sourceMappingURL=prd-sync.js.map

package/dist/lib/work-context/preflight-contract.d.ts

@@ -1,28 +0,0 @@
-/**
- * Offline preflight ContextResult shapes that `hq mesh context reconcile --offline`
- * can emit. migration_pending is a migrate-path status, not a preflight result.
- *
- * contractVersion is WORK_CONTEXT_CONTRACT_VERSION. Bump it only together with
- * contracts/preflight/v<N>/ and the vendored copy in hq-core
- * (core/hooks/SessionStart/preflight-fixtures.json). Each side pins the version
- * in tests; a one-sided bump fails that side until the other is updated.
- */
-import { type ContextResult } from "./contract.js";
-export declare const PREFLIGHT_CONTRACT_VERSION: 1;
-/** Classifications reconcile actually returns on the offline preflight path. */
-export declare const OFFLINE_PREFLIGHT_CLASSIFICATIONS: readonly ["unresolved", "needs_company", "company_conflict", "needs_project", "needs_task", "bound", "untracked"];
-export type OfflinePreflightClassification = (typeof OFFLINE_PREFLIGHT_CLASSIFICATIONS)[number];
-/**
- * One representative result per emitted classification, using the kind and
- * delivery the offline path actually returns (company-resolved results are
- * kind "queued" / delivery "queued"; local-only results are delivery "clean").
- */
-export declare function preflightFixtureFor(classification: OfflinePreflightClassification): ContextResult;
-export interface PreflightFixtureFile {
-    contractVersion: typeof PREFLIGHT_CONTRACT_VERSION;
-    source: "hq-cli contracts/preflight/v1/fixtures.json";
-    classifications: readonly OfflinePreflightClassification[];
-    fixtures: ContextResult[];
-}
-export declare function buildPreflightFixtures(): PreflightFixtureFile;
-//# sourceMappingURL=preflight-contract.d.ts.map

package/dist/lib/work-context/preflight-contract.js

@@ -1,85 +0,0 @@
-/**
- * Offline preflight ContextResult shapes that `hq mesh context reconcile --offline`
- * can emit. migration_pending is a migrate-path status, not a preflight result.
- *
- * contractVersion is WORK_CONTEXT_CONTRACT_VERSION. Bump it only together with
- * contracts/preflight/v<N>/ and the vendored copy in hq-core
- * (core/hooks/SessionStart/preflight-fixtures.json). Each side pins the version
- * in tests; a one-sided bump fails that side until the other is updated.
- */
-import { WORK_CONTEXT_CONTRACT_VERSION, } from "./contract.js";
-export const PREFLIGHT_CONTRACT_VERSION = WORK_CONTEXT_CONTRACT_VERSION;
-/** Classifications reconcile actually returns on the offline preflight path. */
-export const OFFLINE_PREFLIGHT_CLASSIFICATIONS = [
-    "unresolved",
-    "needs_company",
-    "company_conflict",
-    "needs_project",
-    "needs_task",
-    "bound",
-    "untracked",
-];
-const FIXTURE_SESSION = "sid-preflight-fixture";
-const FIXTURE_OP = "op-preflight-fixture";
-function base(classification, kind, delivery) {
-    return {
-        contractVersion: PREFLIGHT_CONTRACT_VERSION,
-        kind,
-        classification,
-        delivery,
-        lifecycle: "open",
-        sessionId: FIXTURE_SESSION,
-        clientOperationId: FIXTURE_OP,
-    };
-}
-/**
- * One representative result per emitted classification, using the kind and
- * delivery the offline path actually returns (company-resolved results are
- * kind "queued" / delivery "queued"; local-only results are delivery "clean").
- */
-export function preflightFixtureFor(classification) {
-    switch (classification) {
-        case "unresolved":
-            return base("unresolved", "queued", "queued");
-        case "needs_company":
-            return base("needs_company", "needs_company", "clean");
-        case "company_conflict":
-            return base("company_conflict", "company_conflict", "clean");
-        case "needs_project":
-            return {
-                ...base("needs_project", "queued", "queued"),
-                companySlug: "acme",
-                companyUid: "cmp_acme",
-            };
-        case "needs_task":
-            return {
-                ...base("needs_task", "queued", "queued"),
-                companySlug: "acme",
-                companyUid: "cmp_acme",
-                projectId: "dispatch-proj",
-            };
-        case "bound":
-            return {
-                ...base("bound", "queued", "queued"),
-                companySlug: "acme",
-                companyUid: "cmp_acme",
-                projectId: "dispatch-proj",
-                taskId: "US-9",
-            };
-        case "untracked":
-            return base("untracked", "untracked", "clean");
-        default: {
-            const never = classification;
-            return never;
-        }
-    }
-}
-export function buildPreflightFixtures() {
-    return {
-        contractVersion: PREFLIGHT_CONTRACT_VERSION,
-        source: "hq-cli contracts/preflight/v1/fixtures.json",
-        classifications: [...OFFLINE_PREFLIGHT_CLASSIFICATIONS],
-        fixtures: OFFLINE_PREFLIGHT_CLASSIFICATIONS.map(preflightFixtureFor),
-    };
-}
-//# sourceMappingURL=preflight-contract.js.map

package/dist/lib/work-context/prompt-rebind.d.ts

@@ -1,25 +0,0 @@
-/**
- * US-040: re-run bind-best for a session still in needs_project, or
- * unresolved once it has a company. The prompt hook and the mesh daemon
- * flush both call this. Catalog reads are cached. Failures stay local.
- */
-export type PromptRebindResult = {
-    action: "bound" | "skipped" | "unchanged";
-    projectId?: string;
-    reason: string;
-};
-export declare function rebindNeedsProjectOnPrompt(input: {
-    sessionId: string;
-    root: string;
-    hqRoot?: string;
-    cwd?: string;
-    companySlug?: string;
-    companyUid?: string;
-    /** Used when the session has no projectHint (for example a spool `project` field). */
-    hint?: string;
-    env?: NodeJS.ProcessEnv;
-    home?: string;
-    nowMs?: number;
-    now?: () => Date;
-}): PromptRebindResult;
-//# sourceMappingURL=prompt-rebind.d.ts.map

package/dist/lib/work-context/prompt-rebind.js

@@ -1,85 +0,0 @@
-/**
- * US-040: re-run bind-best for a session still in needs_project, or
- * unresolved once it has a company. The prompt hook and the mesh daemon
- * flush both call this. Catalog reads are cached. Failures stay local.
- */
-import { projectIdFromCwd } from "./company.js";
-import { readMetaProjectTask } from "./project.js";
-import { refineProjectBinding } from "./bind-best.js";
-import { WORK_CONTEXT_CONTRACT_VERSION } from "./contract.js";
-import { readSessionState, updateSessionState } from "./state.js";
-export function rebindNeedsProjectOnPrompt(input) {
-    let state;
-    try {
-        state = readSessionState(input.sessionId, input.root);
-    }
-    catch {
-        return { action: "skipped", reason: "state_unreadable" };
-    }
-    if (!state)
-        return { action: "skipped", reason: "no_state" };
-    const companyUid = input.companyUid ?? state.companyUid;
-    const retryable = state.contextStatus === "needs_project" ||
-        (state.contextStatus === "unresolved" && Boolean(companyUid));
-    if (!retryable) {
-        return { action: "skipped", reason: "not_needs_project" };
-    }
-    if (state.projectId)
-        return { action: "skipped", reason: "different_project" };
-    const env = input.env ?? process.env;
-    const hint = state.projectHint?.trim() ||
-        input.hint?.trim() ||
-        env.HQ_SPAWN_PROJECT?.trim() ||
-        readMetaProjectTask(input.sessionId, input.hqRoot).projectId ||
-        projectIdFromCwd(input.cwd, input.hqRoot) ||
-        undefined;
-    if (!hint)
-        return { action: "unchanged", reason: "no_hint" };
-    let refined;
-    try {
-        refined = refineProjectBinding({
-            hint,
-            hqRoot: input.hqRoot,
-            companySlug: input.companySlug ?? state.companySlug,
-            companyUid,
-            repoPath: input.cwd,
-            env,
-            home: input.home,
-            nowMs: input.nowMs ?? Date.now(),
-        });
-    }
-    catch (err) {
-        return { action: "unchanged", reason: err instanceof Error ? err.message : "bind_failed" };
-    }
-    if (refined.action !== "bind" && refined.action !== "create") {
-        return { action: "unchanged", reason: refined.action === "ask" ? refined.reason : "no_match" };
-    }
-    const projectId = refined.projectId;
-    const reason = refined.reason;
-    const nowIso = (input.now ?? (() => new Date()))().toISOString();
-    const updated = updateSessionState(input.sessionId, input.root, (current) => {
-        if (!current || (current.contextStatus !== "needs_project" && current.contextStatus !== "unresolved")) {
-            return current;
-        }
-        if (current.contextStatus === "unresolved" && !current.companyUid)
-            return current;
-        if (current.projectId && current.projectId !== projectId)
-            return current;
-        return {
-            ...current,
-            contractVersion: WORK_CONTEXT_CONTRACT_VERSION,
-            contextStatus: current.taskId ? "bound" : "needs_task",
-            projectId,
-            projectGate: undefined,
-            projectCandidates: undefined,
-            projectHint: undefined,
-            projectBindReason: reason,
-            updatedAt: nowIso,
-        };
-    });
-    if (!updated || updated.projectId !== projectId) {
-        return { action: "skipped", reason: "not_applied" };
-    }
-    return { action: "bound", projectId, reason };
-}
-//# sourceMappingURL=prompt-rebind.js.map

package/dist/lib/work-context/windows-acl.d.ts

@@ -1,123 +0,0 @@
-/**
- * Windows DACL check for the work-context config (US-018).
- *
- * NTFS has no POSIX mode bits: Node reports `mode` 0666 for every regular
- * file on win32, so the POSIX `mode & 0o022` test in config.ts can never pass
- * there. Instead of skipping the check on Windows, this module reads the real
- * DACL and refuses the config when any principal other than the current user,
- * SYSTEM, Administrators, or the owner is granted write/modify/full access.
- *
- * How the DACL is read (no native dependency):
- *   `icacls <path> /save <tmpfile>` writes the DACL as an SDDL string
- *   (`D:AI(A;ID;FA;;;SY)(A;ID;FA;;;BA)(A;ID;FA;;;S-1-5-21-...)`). SDDL carries
- *   SIDs or well-known SID abbreviations, never display names, so the check is
- *   independent of the OS language (VORDEFINIERT\Administratoren is still BA /
- *   S-1-5-32-544). The current user's SID comes from `whoami /user`. Display
- *   names are only resolved (via PowerShell) for the error message.
- *
- * Trust is decided by SID: S-1-5-18 (SYSTEM), S-1-5-32-544 (Administrators),
- * S-1-3-0 (CREATOR OWNER), S-1-3-4 (OWNER RIGHTS), the current user's SID and
- * the owner's SID when known.
- *
- * Reduced-guarantee path (explicit, documented): the check does NOT throw and
- * instead emits one stderr diagnostic that the config is unprotected on this
- * platform when, and only when, the DACL cannot be evaluated:
- *   - icacls is missing, fails, or its output has no SDDL line (unreadable);
- *   - an ACE grants write to a principal whose SID we cannot resolve (an SDDL
- *     abbreviation this module does not know), or carries a rights token we
- *     cannot decode, or the current user's SID is unknown and the grant is to
- *     a non-well-known SID (unresolvable).
- * A DACL that parses and grants write to a resolved SID outside the trusted
- * set always throws UnsafeConfigPathError. Nothing else falls back.
- */
-export interface SddlAce {
-    /** ACE type token, e.g. `A` (allow) or `D` (deny). */
-    type: string;
-    /** ACE flag string, e.g. `OICIID`. */
-    flags: string;
-    /** Rights field as written, e.g. `FA`, `0x1200a9`, `CCDCLCSWRPWPRC`. */
-    rights: string;
-    /** Account field as written: full SID or two-letter abbreviation. */
-    account: string;
-}
-export type AclReadResult = {
-    readable: true;
-    sddl: string;
-} | {
-    readable: false;
-    reason: string;
-};
-export interface WindowsAclCheckOptions {
-    /** Current user SID (defaults to `whoami /user`). `null` = unknown. */
-    currentUserSid?: string | null;
-    /** Owner SID when known (icacls /save does not include the owner). */
-    ownerSid?: string | null;
-    /** DACL reader; injectable for tests. Defaults to `icacls <path> /save`. */
-    readAcl?: (targetPath: string) => AclReadResult;
-    /** SID → display name for error messages; injectable for tests. */
-    resolveSidName?: (sid: string) => string | null;
-    /** Diagnostic sink for the reduced-guarantee path (defaults to stderr). */
-    diagnostic?: (line: string) => void;
-}
-export type AclVerdict = {
-    kind: "safe";
-} | {
-    kind: "unsafe";
-    sid: string;
-    rights: string;
-} | {
-    kind: "unresolvable";
-    reason: string;
-};
-export declare const SID_SYSTEM = "S-1-5-18";
-export declare const SID_ADMINISTRATORS = "S-1-5-32-544";
-export declare const SID_CREATOR_OWNER = "S-1-3-0";
-export declare const SID_OWNER_RIGHTS = "S-1-3-4";
-/** Resolve an SDDL account field to a SID, or null when unknown. */
-export declare function sddlAccountToSid(account: string): string | null;
-/** Any of these bits lets the holder change the file or replace it. */
-export declare const WRITE_MASK: number;
-/** Decode an SDDL rights field to an access mask, or null when undecodable. */
-export declare function sddlRightsToMask(rights: string): number | null;
-/**
- * Parse the DACL portion of an SDDL string into ACEs. Accepts a full security
- * descriptor string (`O:...G:...D:...S:...`) or just the `D:` section.
- * Returns null when no DACL section is present or an ACE is malformed.
- */
-export declare function parseSddlDacl(sddl: string): SddlAce[] | null;
-/**
- * Parse the file `icacls <path> /save <file>` writes: UTF-16LE (optional BOM),
- * CRLF, alternating `<name>` / `<sddl>` lines. Returns the SDDL of the first
- * entry (the target itself), or an unreadable result.
- */
-export declare function parseIcaclsSaveOutput(raw: string | Buffer): AclReadResult;
-/**
- * Absolute path of a System32 tool. PATH lookup is not safe here: Git Bash and
- * MSYS environments put a coreutils `whoami` ahead of Windows' `whoami.exe`,
- * which does not understand `/user` and would make the current user SID look
- * unknown on every run.
- */
-export declare function system32Tool(exe: string): string;
-export declare function readAclWithIcaclsSave(targetPath: string): AclReadResult;
-/** Current user's SID via `whoami /user /fo csv /nh`; null when unavailable. */
-export declare function readCurrentUserSid(): string | null;
-/** Best-effort SID → account name (only used to build error messages). */
-export declare function resolveSidNameWithPowerShell(sid: string): string | null;
-/**
- * Evaluate parsed ACEs against the trusted SID set.
- * - `unsafe`: an allow ACE grants a write bit to a resolved, untrusted SID.
- * - `unresolvable`: a write-granting ACE whose SID or rights cannot be decoded,
- *   or whose SID is a per-machine/domain SID while the current user is unknown.
- * - `safe`: everything else (deny ACEs and read-only grants are ignored).
- */
-export declare function evaluateDacl(aces: SddlAce[], opts: Pick<WindowsAclCheckOptions, "currentUserSid" | "ownerSid">): AclVerdict;
-/**
- * Assert the Windows DACL of `targetPath` grants write only to trusted
- * principals. Throws UnsafeConfigPathError naming the offending principal.
- * Unreadable or unresolvable DACL → reduced-guarantee diagnostic (once per
- * path), no throw. See the module header for the exact conditions.
- */
-export declare function assertWindowsOwnerOnlyAcl(targetPath: string, kind: "file" | "directory", opts?: WindowsAclCheckOptions): void;
-/** Test hook: forget which paths already emitted the reduced-guarantee line. */
-export declare function resetWindowsAclDiagnostics(): void;
-//# sourceMappingURL=windows-acl.d.ts.map