@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/archive-deadline.js

@@ -18,11 +18,13 @@ export function createPipelineTimeoutError(err, deadline) {
     return err;
 }
 export async function waitForDeadline(promise, deadline) {
+    // An elapsed synchronous check must not orphan a later operation rejection.
+    void promise.catch(() => undefined);
     deadline.check();
     if (deadline.signal.aborted) {
         throw deadlineReason(deadline);
     }
-    return await Promise.race([
+    const result = await Promise.race([
         promise,
         new Promise((_, reject) => {
             const abort = () => reject(deadlineReason(deadline));
@@ -33,21 +35,26 @@ export async function waitForDeadline(promise, deadline) {
             promise.then(cleanup, cleanup);
         }),
     ]);
+    deadline.check();
+    return result;
 }
 function createDestinationMutationOwner(check) {
     const active = new Set();
     return {
         ownDestinationMutation: async (run) => {
             check();
-            const operation = Promise.resolve().then(run);
-            const tracked = operation.then(() => undefined, () => undefined);
-            active.add(tracked);
-            void tracked.finally(() => active.delete(tracked));
-            return await operation;
+            const operation = Promise.resolve().then(() => { check(); return run(); });
+            active.add(operation);
+            try {
+                return await operation;
+            }
+            finally {
+                active.delete(operation);
+            }
         },
         waitForDestinationMutations: async () => {
             while (active.size > 0) {
-                await Promise.all(active);
+                await Promise.allSettled(active);
             }
         },
     };
@@ -55,35 +62,27 @@ function createDestinationMutationOwner(check) {
 function createExtractionDeadline(timeoutMs, label) {
     const controller = new AbortController();
     const timeoutError = new Error(`${label} timed out after ${timeoutMs}ms`);
+    const enabled = Number.isFinite(timeoutMs) && timeoutMs > 0;
+    const startedAt = enabled ? performance.now() : 0;
     const check = () => {
+        if (enabled && !controller.signal.aborted && performance.now() - startedAt >= timeoutMs) {
+            controller.abort(timeoutError);
+        }
         if (controller.signal.aborted) {
             throw signalReason(controller.signal, timeoutError);
         }
     };
-    const mutationOwner = createDestinationMutationOwner(check);
-    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
-        return {
-            signal: controller.signal,
-            check,
-            ...mutationOwner,
-            dispose: () => undefined,
-        };
-    }
-    const cancelTimeout = scheduleTimeout(() => {
-        controller.abort(timeoutError);
-    }, timeoutMs);
     return {
         signal: controller.signal,
         check,
-        ...mutationOwner,
-        dispose: cancelTimeout,
+        ...createDestinationMutationOwner(check),
+        dispose: enabled ? scheduleTimeout(() => controller.abort(timeoutError), timeoutMs) : () => undefined,
     };
 }
 export async function withExtractionDeadline(timeoutMs, label, run) {
     const deadline = createExtractionDeadline(timeoutMs, label);
-    const operation = Promise.resolve().then(async () => await run(deadline));
+    const operation = Promise.resolve().then(() => { deadline.check(); return run(deadline); });
     try {
-        deadline.check();
         try {
             return await waitForDeadline(operation, deadline);
         }

package/node_modules/@openclaw/fs-safe/dist/archive-durability.d.ts

@@ -1,6 +1,6 @@
 import { type ExtractionDeadline } from "./archive-deadline.js";
 import { type ArchiveDirectoryGuard } from "./archive-staging.js";
-import type { PublishedWriteIdentity } from "./pinned-write.js";
+import type { PublishedWriteIdentity } from "./pinned-write-types.js";
 import type { Root } from "./root.js";
 export type ArchivePublishedFile = {
     relativePath: string;
@@ -21,4 +21,3 @@ export declare function finalizeArchivePublication(params: {
     durable: boolean;
     deadline?: ExtractionDeadline;
 }): Promise<void>;
-//# sourceMappingURL=archive-durability.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-entry.d.ts

@@ -11,4 +11,3 @@ export declare function resolveArchiveOutputPath(params: {
     originalPath: string;
     escapeLabel?: string;
 }): string;
-//# sourceMappingURL=archive-entry.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-errors.d.ts

@@ -10,4 +10,3 @@ export declare class ArchiveFormatError extends Error {
 }
 export declare function isArchiveFormatErrorMessage(message: string): boolean;
 export declare function isArchiveTarPathErrorMessage(message: string): boolean;
-//# sourceMappingURL=archive-errors.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-gzip-tail.d.ts

@@ -18,4 +18,3 @@ export declare class GzipInput extends Writable {
 /** Check the immutable staged suffix from the first unused physical byte,
  * including later chunks the decoder may have consumed, before returning. */
 export declare function validateGzipContainerTail(filePath: string, consumed: number, signal?: AbortSignal): Promise<void>;
-//# sourceMappingURL=archive-gzip-tail.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-input.d.ts

@@ -16,4 +16,3 @@ export declare function stageArchiveFileForExtraction(params: {
     limits: ResolvedArchiveExtractLimits;
     deadline: ExtractionDeadline;
 }): Promise<StagedArchiveFile>;
-//# sourceMappingURL=archive-input.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-kind.d.ts

@@ -4,6 +4,4 @@ type ResolvePackedRootDirOptions = {
     rootMarkers?: string[];
 };
 export declare function resolvePackedRootDir(extractDir: string, options?: ResolvePackedRootDirOptions): Promise<string>;
-export declare function assertPortableArchiveKind(kind: ArchiveKind): void;
 export {};
-//# sourceMappingURL=archive-kind.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-kind.js

@@ -1,29 +1,23 @@
 import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { FsSafeError } from "./errors.js";
 import { getNativeBinding } from "./native.js";
 import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
 const TAR_SUFFIXES = [".tgz", ".tar.gz", ".tar"];
-const NATIVE_TAR_SUFFIXES = [
+const COMPRESSED_TAR_SUFFIXES = [
     { suffixes: [".tbz2", ".tbz", ".tar.bz2"], kind: "tar-bzip2" },
     { suffixes: [".tzst", ".tar.zst", ".tar.zstd"], kind: "tar-zstd" },
 ];
-function requireNativeArchiveKind(kind) {
-    if (!getNativeBinding()) {
-        throw new FsSafeError("helper-unavailable", `${kind} archives require the matching optional native platform package; ` +
-            "install @openclaw/fs-safe with optional dependencies enabled on a supported platform and use FS_SAFE_NATIVE_MODE=auto or require");
-    }
-    return kind;
-}
 export function resolveArchiveKind(filePath) {
     const lower = normalizeLowercaseStringOrEmpty(filePath);
     if (lower.endsWith(".zip")) {
         return "zip";
     }
-    for (const { suffixes, kind } of NATIVE_TAR_SUFFIXES) {
+    for (const { suffixes, kind } of COMPRESSED_TAR_SUFFIXES) {
         if (suffixes.some((suffix) => lower.endsWith(suffix))) {
-            return requireNativeArchiveKind(kind);
+            // Preserve strict require diagnostics even when only resolving a suffix.
+            getNativeBinding();
+            return kind;
         }
     }
     if (TAR_SUFFIXES.some((suffix) => lower.endsWith(suffix))) {
@@ -75,9 +69,3 @@ export async function resolvePackedRootDir(extractDir, options) {
     }
     return path.join(extractDir, onlyDir);
 }
-export function assertPortableArchiveKind(kind) {
-    if (kind === "tar-zstd" || kind === "tar-bzip2") {
-        throw new FsSafeError("helper-unavailable", `${kind} archives require the matching optional native platform package; ` +
-            "install @openclaw/fs-safe with optional dependencies enabled on a supported platform and use FS_SAFE_NATIVE_MODE=auto or require");
-    }
-}

package/node_modules/@openclaw/fs-safe/dist/archive-limits.d.ts

@@ -54,4 +54,3 @@ export declare function createByteBudgetTracker(limits: ResolvedArchiveExtractLi
 export declare function createExtractBudgetTransform(params: {
     onChunkBytes: (bytes: number) => void;
 }): Transform;
-//# sourceMappingURL=archive-limits.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-merge.d.ts

@@ -14,10 +14,9 @@ type MergeParams = {
 type GuardedMergeParams = Pick<MergeParams, "sourceDir" | "deadline"> & {
     destinationGuard: ArchiveDirectoryGuard;
 };
-export declare function mergePlannedArchiveIntoDestination(params: GuardedMergeParams & {
-    entries: readonly ArchivePublicationEntry[];
+export declare function withStagedArchivePublication(params: Omit<GuardedMergeParams, "sourceDir"> & {
     durable?: boolean;
-}): Promise<void>;
+    entryUmask?: number;
+}, extract: (stagingDir: string) => Promise<readonly ArchivePublicationEntry[]>): Promise<void>;
 export declare function mergeExtractedTreeIntoDestination(params: MergeParams): Promise<void>;
 export {};
-//# sourceMappingURL=archive-merge.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-merge.js

@@ -2,22 +2,35 @@ import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { ownExtractionDestinationMutation } from "./archive-deadline.js";
-import { assertDirectoryIdentityGuard, assertResolvedInsideDestination, createDirectoryIdentityGuard, createArchiveSymlinkTraversalError, preparePrivateArchiveOutputPath, } from "./archive-staging.js";
+import { assertDirectoryIdentityGuard, assertResolvedInsideDestination, createDirectoryIdentityGuard, createArchiveSymlinkTraversalError, preparePrivateArchiveOutputPath, withStagedArchiveDestination, } from "./archive-staging.js";
 import {} from "./directory-mode-owner.js";
 import { pinNodeDirectoryForMode } from "./directory-mode-node.js";
+import { assertSyncDirectoryGuard, inspectDirectoryIdentitySync } from "./directory-guard.js";
 import { FsSafeError } from "./errors.js";
 import { formatErrorDetail } from "./error-detail.js";
-import { isPathInside } from "./path.js";
+import { isNotFoundPathError, isPathInside } from "./path.js";
 import { rootFromDirectoryGuard } from "./root-impl.js";
+import { admitPathInsideRoot } from "./root-boundary.js";
 import { realpathSync } from "./realpath.js";
 import { getFsSafeTestHooks } from "./test-hooks.js";
-import { onCopyPublication } from "./copy-publication.js";
+import { onCopyPublication, onCopySourceAdmission } from "./copy-publication.js";
 import { syncFileBestEffortSync } from "./file-sync.js";
 import { finalizeArchivePublication } from "./archive-durability.js";
 import { assertNoWindowsPathAlias } from "./windows-path-alias.js";
-export async function mergePlannedArchiveIntoDestination(params) {
-    assertMergePathInputs(params);
-    await mergeTree(params, params.entries, params.durable === true);
+import { inspectFileIdentitySync } from "./strict-file-identity.js";
+export async function withStagedArchivePublication(params, extract) {
+    await withStagedArchiveDestination({
+        destinationRealDir: params.destinationGuard.realPath,
+        run: async (stagingPath) => {
+            const sourceDir = realpathSync.native(stagingPath);
+            const entries = await extract(sourceDir);
+            params.deadline?.check();
+            const mergeParams = { ...params, sourceDir };
+            assertMergePathInputs(mergeParams);
+            await mergeTree(mergeParams, entries, params.durable === true, params.entryUmask);
+            params.deadline?.check();
+        },
+    });
 }
 export async function mergeExtractedTreeIntoDestination(params) {
     const sourceDir = params.sourceDir;
@@ -34,7 +47,7 @@ function assertMergePathInputs(params) {
     assertNoWindowsPathAlias(params.destinationGuard.dir);
     assertNoWindowsPathAlias(params.destinationGuard.realPath);
 }
-async function mergeTree(params, publication, durable = true) {
+async function mergeTree(params, publication, durable = true, entryUmask = 0) {
     const publishedFiles = [];
     const publishedDirectories = [];
     const check = () => params.deadline?.check();
@@ -58,6 +71,33 @@ async function mergeTree(params, publication, durable = true) {
         plan.set(stagedPath, entry);
     }
     const ancestors = [];
+    const sourceAncestors = [];
+    const assertSourceDirectory = (guard, canonical = false) => {
+        try {
+            // Child receipts already retain canonical ancestry. An exact no-follow
+            // observation checks each named association without re-running realpath.
+            if (canonical)
+                assertSyncDirectoryGuard(guard);
+            else
+                inspectDirectoryIdentitySync(guard.dir, guard.stat);
+        }
+        catch (error) {
+            if (error instanceof FsSafeError || isNotFoundPathError(error)) {
+                throw createArchiveSymlinkTraversalError(path.relative(params.sourceDir, guard.dir));
+            }
+            throw error;
+        }
+        check();
+    };
+    const assertSourceFrontier = () => {
+        const current = sourceAncestors.at(-1);
+        if (current)
+            assertSourceDirectory(current);
+    };
+    const assertSourceAncestors = () => {
+        for (const ancestor of sourceAncestors)
+            assertSourceDirectory(ancestor);
+    };
     const assertGuards = async () => {
         await assertDirectoryIdentityGuard(destinationGuard);
         check();
@@ -72,15 +112,21 @@ async function mergeTree(params, publication, durable = true) {
     };
     const walk = async (sourceDir) => {
         await assertGuards();
+        assertSourceFrontier();
         const entries = await fs.readdir(sourceDir, { withFileTypes: true });
         check();
+        if (entries.length === 0) {
+            await assertGuards();
+            assertSourceFrontier();
+        }
         for (const entry of entries) {
             await assertGuards();
+            assertSourceFrontier();
             const sourcePath = path.join(sourceDir, entry.name);
             const relPath = path.relative(params.sourceDir, sourcePath);
             const originalPath = relPath.split(path.sep).join("/");
             const destinationPath = path.join(destinationDir, relPath);
-            const sourceStat = fsSync.lstatSync(sourcePath);
+            const sourceStat = inspectFileIdentitySync(() => fsSync.lstatSync(sourcePath, { bigint: true }));
             check();
             if (sourceStat.isSymbolicLink())
                 throw createArchiveSymlinkTraversalError(originalPath);
@@ -96,68 +142,99 @@ async function mergeTree(params, publication, durable = true) {
             if (plan && ((planned && planned.kind !== kind) || (!planned && kind === "file"))) {
                 throw new FsSafeError("path-mismatch", "archive staging disagrees with the admitted publication plan");
             }
-            const mode = plan ? planned?.mode ?? 0o755 : sourceStat.mode & 0o777;
+            let mode = plan ? (planned?.mode ?? 0o755) & ~entryUmask : Number(sourceStat.mode & 511n);
             await preparePrivateArchiveOutputPath({
                 destinationDir, destinationRealDir, deadline: params.deadline,
                 relPath, outPath: destinationPath, originalPath, isDirectory: kind === "directory",
             }, assertGuards, destinationGuard);
             check();
             if (kind === "directory") {
-                // Ownership spans open, descendants, finalization and close, including timeout.
-                await ownExtractionDestinationMutation(params.deadline, async () => {
-                    await assertGuards();
-                    const owner = await pinNodeDirectoryForMode(destinationPath).catch((error) => {
-                        if (error instanceof FsSafeError && (error.code === "not-file" || error.code === "path-mismatch")) {
-                            throw createArchiveSymlinkTraversalError(originalPath);
-                        }
-                        throw error;
-                    });
-                    try {
-                        check();
-                        const guard = await createDirectoryIdentityGuard(destinationPath);
-                        check();
-                        await owner.verify(check);
-                        ancestors.push({ guard, owner });
-                        try {
-                            await walk(sourcePath);
-                            if (publication) {
-                                await assertGuards();
-                                publishedDirectories.push({ guard, mode, parents: ancestors.slice(0, -1).map((ancestor) => ancestor.guard) });
-                                return;
+                // Retain the observation made before output preparation: recapturing
+                // here could silently authorize a replacement source directory.
+                sourceAncestors.push({ dir: sourcePath, realPath: sourceReal, stat: sourceStat });
+                try {
+                    // Ownership spans open, descendants, finalization and close, including timeout.
+                    await ownExtractionDestinationMutation(params.deadline, async () => {
+                        await assertGuards();
+                        assertSourceFrontier();
+                        const owner = await pinNodeDirectoryForMode(destinationPath).catch((error) => {
+                            if (error instanceof FsSafeError && (error.code === "not-file" || error.code === "path-mismatch")) {
+                                throw createArchiveSymlinkTraversalError(originalPath);
                             }
-                            await getFsSafeTestHooks()?.beforeArchiveOutputMutation?.("chmod", destinationPath);
+                            throw error;
+                        });
+                        try {
                             check();
-                            await assertGuards();
-                            // Do not recursively verify this owner from inside its serialized apply.
-                            ancestors.pop();
-                            await owner.apply(mode, { check, beforeChmod: async () => {
-                                    await assertGuards();
-                                    await assertDirectoryIdentityGuard(guard);
-                                    check();
-                                    await assertResolvedInsideDestination({
-                                        destinationRealDir, targetPath: destinationPath, originalPath,
-                                    });
-                                    check();
-                                } });
+                            const guard = await createDirectoryIdentityGuard(destinationPath);
                             check();
-                            await assertGuards();
+                            await owner.verify(check);
+                            ancestors.push({ guard, owner });
+                            try {
+                                await walk(sourcePath);
+                                if (publication) {
+                                    await assertGuards();
+                                    assertSourceAncestors();
+                                    publishedDirectories.push({ guard, mode, parents: ancestors.slice(0, -1).map((ancestor) => ancestor.guard) });
+                                    return;
+                                }
+                                await getFsSafeTestHooks()?.beforeArchiveOutputMutation?.("chmod", destinationPath);
+                                check();
+                                await assertGuards();
+                                // Do not recursively verify this owner from inside its serialized apply.
+                                ancestors.pop();
+                                await owner.apply(mode, { check, beforeChmod: async () => {
+                                        await assertGuards();
+                                        assertSourceAncestors();
+                                        await assertDirectoryIdentityGuard(guard);
+                                        check();
+                                        await assertResolvedInsideDestination({
+                                            destinationRealDir, targetPath: destinationPath, originalPath,
+                                        });
+                                        check();
+                                    } });
+                                check();
+                                await assertGuards();
+                                assertSourceAncestors();
+                            }
+                            finally {
+                                if (ancestors.at(-1)?.owner === owner)
+                                    ancestors.pop();
+                            }
                         }
                         finally {
-                            if (ancestors.at(-1)?.owner === owner)
-                                ancestors.pop();
+                            await owner.close();
                         }
-                    }
-                    finally {
-                        await owner.close();
-                    }
-                });
+                    });
+                }
+                finally {
+                    sourceAncestors.pop();
+                }
             }
             else {
                 await ownExtractionDestinationMutation(params.deadline, async () => {
                     await assertGuards();
                     try {
                         const options = {
-                            mkdir: true, mode, durable: publication ? false : true,
+                            mkdir: false, mode, durable: publication ? false : true,
+                            [onCopySourceAdmission]: (identity, realPath) => {
+                                assertSourceDirectory(sourceGuard, true);
+                                assertSourceFrontier();
+                                inspectFileIdentitySync(() => identity, sourceStat);
+                                if (!admitPathInsideRoot({
+                                    rootPath: sourceGuard.realPath, candidatePath: realPath, rootIdentity: sourceGuard.stat,
+                                }))
+                                    throw createArchiveSymlinkTraversalError(originalPath);
+                                // Public merge permissions come from the admitted descriptor;
+                                // extraction keeps the separately admitted publication plan.
+                                if (!plan)
+                                    mode = Number(identity.mode & 511n);
+                                return { mode, verify() {
+                                        // Only copy publication boundaries scan the active chain.
+                                        // Destination mkdir callbacks must not multiply this work.
+                                        assertSourceDirectory(sourceGuard, true);
+                                        assertSourceAncestors();
+                                    } };
+                            },
                         };
                         if (publication && durable) {
                             options[onCopyPublication] = async (fd, identity) => {

package/node_modules/@openclaw/fs-safe/dist/archive-parser-errors.d.ts

@@ -1,2 +1 @@
 export declare function classifyArchiveParserError(message: string, options?: ErrorOptions): Error | undefined;
-//# sourceMappingURL=archive-parser-errors.d.ts.map

package/node_modules/@openclaw/fs-safe/dist/archive-plan.d.ts

@@ -1,5 +1,6 @@
 import type { ArchiveKind } from "./archive-kind.js";
-import type { ExtractArchiveOptions } from "./archive-options.js";
+import { type ResolvedArchiveExtractLimits, type ArchiveExtractLimits } from "./archive-limits.js";
+import type { ExtractionDeadline } from "./archive-deadline.js";
 export type ArchiveMemberKind = "file" | "directory" | "symlink" | "hardlink" | "blocked" | "sparse" | "other";
 export type ArchivePlanEntry = {
     path: string;
@@ -11,10 +12,79 @@ export type ArchivePlanOptions = Pick<ExtractArchiveOptions, "stripComponents" |
     rootDir?: string;
     escapeLabel?: string;
 };
+export declare function createArchiveEntrySelector(params: ArchivePlanOptions): {
+    limits: ResolvedArchiveExtractLimits;
+    select(entry: {
+        path: string;
+        kind: ArchiveEntryKind;
+        size: number;
+    }): string | null;
+};
 export declare function createArchiveEntryPlanner(params: ArchivePlanOptions, archiveKind: ArchiveKind): (entry: {
     path: string;
     kind: ArchiveMemberKind;
     size: number;
     mode?: number;
 }) => ArchivePlanEntry | null;
-//# sourceMappingURL=archive-plan.d.ts.map
+export type ArchiveEntryKind = "file" | "directory" | "symlink" | "other";
+export type ArchiveEntryModePolicy = "clamp" | "preserve";
+export type ArchiveFilteredEntryPolicy = "reject-archive" | "skip-entry";
+export type ArchiveEntryFilter = (entry: {
+    /** Validated canonical archive path before stripping: / separators, no empty or . components. */
+    path: string;
+    kind: ArchiveEntryKind;
+    size: number;
+}) => "extract" | "skip";
+export declare function archiveEntryKindFromTarType(type: string): ArchiveEntryKind;
+export declare function resolveArchiveEntryMode(params: {
+    kind: "file" | "directory";
+    archivedMode?: number | null;
+    policy?: ArchiveEntryModePolicy;
+}): number;
+export declare function resolveArchiveFilteredEntryPolicy(value: unknown): ArchiveFilteredEntryPolicy;
+export declare function shouldExtractArchiveEntry(params: {
+    filter?: ArchiveEntryFilter;
+    onFiltered?: ArchiveFilteredEntryPolicy;
+    entry: Parameters<ArchiveEntryFilter>[0];
+}): boolean;
+export type TarEntryInfo = {
+    path: string;
+    type: string;
+    size: number;
+    mode?: number;
+};
+export declare function createTarEntryPlanner(params: ArchivePlanOptions): (entry: TarEntryInfo) => ArchivePlanEntry | null;
+export declare function createTarEntryPreflightChecker(params: {
+    rootDir: string;
+    stripComponents?: number;
+    limits?: ArchiveExtractLimits;
+    escapeLabel?: string;
+    entryFilter?: ArchiveEntryFilter;
+    onFiltered?: ArchiveFilteredEntryPolicy;
+}): (entry: TarEntryInfo) => boolean;
+export type ArchiveLogger = {
+    info?: (message: string) => void;
+    warn?: (message: string) => void;
+};
+export type ExtractArchiveOptions = {
+    archivePath: string;
+    destDir: string;
+    timeoutMs: number;
+    /** Sync published files and directories before returning. Defaults to false. */
+    durable?: boolean;
+    kind?: ArchiveKind;
+    stripComponents?: number;
+    tarGzip?: boolean;
+    limits?: ArchiveExtractLimits;
+    logger?: ArchiveLogger;
+    entryModes?: ArchiveEntryModePolicy;
+    /** Remove these rwx bits from final entry modes. Defaults to zero. */
+    entryUmask?: number;
+    entryFilter?: ArchiveEntryFilter;
+    onFiltered?: ArchiveFilteredEntryPolicy;
+};
+/** Private executors receive owned options and an already-staged archive path. */
+export type StagedArchiveExtractOptions = Pick<ExtractArchiveOptions, "archivePath" | "destDir" | "durable" | "stripComponents" | "entryModes" | "entryUmask" | "entryFilter" | "onFiltered"> & {
+    limits: ResolvedArchiveExtractLimits;
+    deadline: ExtractionDeadline;
+};