@openclaw/signal 2026.9.5 → 2026.9.6

package/node_modules/@openclaw/fs-safe/dist/permissions-windows.js

@@ -0,0 +1,319 @@
+import os from "node:os";
+import { getNativeBinding } from "./native.js";
+import { executePermissionCommand } from "./permission-exec.js";
+import { safeStat } from "./permissions.js";
+import { normalizeLowercaseStringOrEmpty } from "./string-coerce.js";
+import { resolveWindowsSystemCommand } from "./windows-command.js";
+import { inspectWindowsOwner } from "./windows-owner.js";
+import { hasWindowsPathAlias } from "./windows-path-alias.js";
+const INHERIT_FLAGS = new Set(["I", "OI", "CI", "IO", "NP"]);
+const WORLD_PRINCIPALS = new Set(["everyone", "users", "builtin\\users", "authenticated users", "nt authority\\authenticated users", "anonymous logon", "nt authority\\anonymous logon", "guests", "builtin\\guests", "interactive", "nt authority\\interactive", "network", "nt authority\\network", "local"]);
+const TRUSTED_BASE = new Set([
+    "nt authority\\system",
+    "system",
+    "builtin\\administrators",
+    "creator owner",
+    "autorite nt\\système",
+    "nt-autorität\\system",
+    "autoridad nt\\system",
+    "autoridade nt\\system",
+]);
+const WORLD_SUFFIXES = ["\\users", "\\authenticated users"];
+const SID_RE = /^\*?s-\d+-\d+(-\d+)+$/i;
+const TRUSTED_SIDS = new Set([
+    "s-1-5-18",
+    "s-1-5-32-544",
+    "s-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464",
+]);
+const WORLD_SIDS = new Set(["s-1-1-0", "s-1-5-11", "s-1-5-32-545", "s-1-5-7", "s-1-5-32-546", "s-1-5-4", "s-1-2-0", "s-1-5-2"]);
+const STATUS_PREFIXES = [
+    "successfully processed",
+    "processed",
+    "failed processing",
+    "no mapping between account names",
+];
+function stripDiacritics(value) {
+    return value.normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+}
+const TRUSTED_BASE_ASCII = new Set([...TRUSTED_BASE].map(stripDiacritics));
+const normalize = (value) => normalizeLowercaseStringOrEmpty(value);
+const defaultWindowsUserInfo = () => os.userInfo();
+const defaultPermissionExec = executePermissionCommand;
+function inspectWindowsPermissionsNative(targetPath, unverified) {
+    const native = getNativeBinding();
+    if (!native)
+        return undefined;
+    try {
+        const facts = native.readOwnerAndDacl(targetPath);
+        if (facts.fallbackRequired)
+            return undefined;
+        return {
+            ...unverified,
+            source: "windows-acl",
+            worldWritable: facts.worldWritable,
+            groupWritable: facts.groupWritable,
+            worldReadable: facts.worldReadable,
+            groupReadable: facts.groupReadable,
+            ownerSid: facts.ownerSid,
+            ownerTrusted: facts.ownerClass !== "foreign",
+            aclSummary: `native owner=${facts.ownerClass} world=` +
+                `${facts.worldReadable ? "r" : "-"}${facts.worldWritable ? "w" : "-"} ` +
+                `group=${facts.groupReadable ? "r" : "-"}${facts.groupWritable ? "w" : "-"}`,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function inspectWindowsPermissions(targetPath, unverified, opts) {
+    if (hasWindowsPathAlias(targetPath, "filesystem", "win32")) {
+        return {
+            ...unverified,
+            error: "Path uses a Windows filesystem namespace alias",
+        };
+    }
+    const native = inspectWindowsPermissionsNative(targetPath, unverified);
+    if (native)
+        return native;
+    const owner = await inspectWindowsOwner({
+        targetPath,
+        env: opts?.env,
+        exec: opts?.exec ?? defaultPermissionExec,
+    });
+    if (owner.error !== undefined) {
+        const error = `Windows owner inspection failed: ${owner.error}`;
+        return { ...unverified, ownerError: owner.error, error, errorDetail: owner.errorDetail, errorCause: owner.errorCause };
+    }
+    const acl = summarizeWindowsOwnerAcl(owner);
+    const ownerFields = {
+        ...(owner.sid ? { ownerSid: owner.sid } : {}),
+        ...(owner.trusted !== undefined ? { ownerTrusted: owner.trusted } : {}),
+        ...(owner.error ? { ownerError: owner.error } : {}),
+    };
+    if (!acl.ok)
+        return { ...unverified, ...ownerFields, error: acl.error, errorDetail: acl.errorDetail, errorCause: acl.errorCause };
+    return {
+        ...unverified,
+        source: "windows-acl",
+        worldWritable: acl.untrustedWorld.some((entry) => entry.canWrite),
+        groupWritable: acl.untrustedGroup.some((entry) => entry.canWrite),
+        worldReadable: acl.untrustedWorld.some((entry) => entry.canRead),
+        groupReadable: acl.untrustedGroup.some((entry) => entry.canRead),
+        ...ownerFields,
+        aclSummary: formatWindowsAclSummary(acl),
+    };
+}
+function normalizeSid(value) {
+    const normalized = normalize(value);
+    return normalized.startsWith("*") ? normalized.slice(1) : normalized;
+}
+export function resolveWindowsUserPrincipal(env, userInfo = defaultWindowsUserInfo) {
+    const username = env?.USERNAME?.trim() || userInfo().username?.trim();
+    if (!username)
+        return null;
+    const domain = env?.USERDOMAIN?.trim();
+    return domain ? `${domain}\\${username}` : username;
+}
+function buildTrustedSidPrincipals(env) {
+    const trusted = new Set();
+    const userSid = normalizeSid(env?.USERSID ?? "");
+    if (userSid && SID_RE.test(userSid) && !WORLD_SIDS.has(userSid))
+        trusted.add(userSid);
+    return trusted;
+}
+function buildTrustedPrincipals(env) {
+    const trusted = new Set([
+        ...TRUSTED_BASE,
+        ...buildTrustedSidPrincipals(env),
+    ]);
+    const principal = resolveWindowsUserPrincipal(env);
+    if (principal) {
+        trusted.add(normalize(principal));
+        const userOnly = principal.split("\\").at(-1);
+        if (userOnly)
+            trusted.add(normalize(userOnly));
+    }
+    return trusted;
+}
+function classifyPrincipal(principal, trustedPrincipals) {
+    const normalized = normalize(principal);
+    if (SID_RE.test(normalized)) {
+        const sid = normalizeSid(normalized);
+        if (WORLD_SIDS.has(sid))
+            return "world";
+        if (TRUSTED_SIDS.has(sid) || trustedPrincipals.has(sid))
+            return "trusted";
+        return "group";
+    }
+    if (trustedPrincipals.has(normalized) || TRUSTED_BASE.has(normalized))
+        return "trusted";
+    if (WORLD_PRINCIPALS.has(normalized) || WORLD_SUFFIXES.some((suffix) => normalized.endsWith(suffix)))
+        return "world";
+    const stripped = stripDiacritics(normalized);
+    return stripped !== normalized && TRUSTED_BASE_ASCII.has(stripped) ? "trusted" : "group";
+}
+function rightsFromTokens(tokens) {
+    const upper = tokens.join("").toUpperCase();
+    return {
+        canWrite: upper.includes("F") || upper.includes("M") || upper.includes("W") || upper.includes("D"),
+        canRead: upper.includes("F") || upper.includes("M") || upper.includes("R"),
+    };
+}
+function stripTargetPrefix(params) {
+    if (params.lowerLine.startsWith(params.lowerTarget))
+        return params.trimmedLine.slice(params.normalizedTarget.length).trim();
+    if (params.lowerLine.startsWith(params.quotedLower))
+        return params.trimmedLine.slice(params.quotedTarget.length).trim();
+    return params.trimmedLine;
+}
+function parseAceEntry(entry) {
+    if (!entry.includes("("))
+        return null;
+    const idx = entry.indexOf(":");
+    if (idx === -1)
+        return null;
+    const principal = entry.slice(0, idx).trim();
+    const rawRights = entry.slice(idx + 1).trim();
+    const tokens = rawRights.match(/\(([^)]+)\)/g)?.map((token) => token.slice(1, -1).trim()).filter(Boolean) ?? [];
+    if (tokens.some((token) => token.toUpperCase() === "DENY"))
+        return null;
+    const rights = tokens.filter((token) => !INHERIT_FLAGS.has(token.toUpperCase()));
+    if (rights.length === 0)
+        return null;
+    const normalizedPrincipal = normalizeSid(principal);
+    return { principal, ...(SID_RE.test(normalizedPrincipal) ? { sid: normalizedPrincipal } : {}), rights, rawRights, ...rightsFromTokens(rights) };
+}
+export function parseIcaclsOutput(output, targetPath) {
+    const entries = [];
+    const normalizedTarget = targetPath.trim();
+    const lowerTarget = normalizedTarget.toLowerCase();
+    const quotedTarget = `"${normalizedTarget}"`;
+    const quotedLower = quotedTarget.toLowerCase();
+    for (const rawLine of output.split(/\r?\n/)) {
+        const line = rawLine.trimEnd();
+        if (!line.trim())
+            continue;
+        const trimmed = line.trim();
+        const lowerLine = trimmed.toLowerCase();
+        if (STATUS_PREFIXES.some((prefix) => lowerLine.startsWith(prefix)))
+            continue;
+        const parsed = parseAceEntry(stripTargetPrefix({ trimmedLine: trimmed, lowerLine, normalizedTarget, lowerTarget, quotedTarget, quotedLower }));
+        if (parsed)
+            entries.push(parsed);
+    }
+    return entries;
+}
+export function summarizeWindowsAcl(entries, env) {
+    // Canonical SID entries cannot match account names. Classify them directly
+    // so structured descriptor facts do not depend on a separate user lookup.
+    const trustedPrincipals = entries.every((entry) => SID_RE.test(normalize(entry.sid ?? entry.principal)))
+        ? buildTrustedSidPrincipals(env)
+        : buildTrustedPrincipals(env);
+    const trusted = [];
+    const untrustedWorld = [];
+    const untrustedGroup = [];
+    for (const entry of entries) {
+        const classification = classifyPrincipal(entry.sid ?? entry.principal, trustedPrincipals);
+        if (classification === "trusted")
+            trusted.push(entry);
+        else if (classification === "world")
+            untrustedWorld.push(entry);
+        else
+            untrustedGroup.push(entry);
+    }
+    return { trusted, untrustedWorld, untrustedGroup };
+}
+const MASK_RIGHTS = [
+    [0x1000_0000, "GA"], [0x8000_0000, "GR"], [0x4000_0000, "GW"], [0x2000_0000, "GE"],
+    [0x0001_0000, "D"], [0x0002_0000, "RC"], [0x0004_0000, "WDAC"], [0x0008_0000, "WO"],
+    [0x0010_0000, "S"], [0x0001, "RD"], [0x0002, "WD"], [0x0004, "AD"],
+    [0x0008, "REA"], [0x0010, "WEA"], [0x0020, "X"], [0x0040, "DC"], [0x0080, "RA"], [0x0100, "WA"],
+];
+function summarizeWindowsOwnerAcl(owner) {
+    const error = owner.error ?? owner.aclError;
+    if (error || owner.daclPresent === undefined || !owner.aces || !owner.currentUserSid) {
+        return {
+            ok: false, entries: [], trusted: [], untrustedWorld: [], untrustedGroup: [],
+            error: error ?? "Windows ACL query returned incomplete descriptor data",
+            errorDetail: owner.errorDetail, errorCause: owner.errorCause,
+        };
+    }
+    // A null DACL grants everyone full access; an empty DACL grants nothing.
+    const grants = owner.daclPresent ? owner.aces : [{ sid: "s-1-1-0", mask: 0x001f_01ff, deny: false, inheritOnly: false }];
+    const entries = grants.filter(ace => !ace.deny && !ace.inheritOnly).map(ace => {
+        const rights = ace.mask === 0x001f_01ff ? ["F"] : MASK_RIGHTS.filter(([mask]) => (ace.mask & mask) !== 0).map(([, name]) => name);
+        return {
+            principal: ace.sid, sid: ace.sid, rights, rawRights: "(" + rights.join(",") + ")",
+            // Retain the coarse policy's conservative treatment of read-control and
+            // mutation rights. Denies do not subtract grants or claim effective access.
+            canRead: (ace.mask & 0x9002_0089) !== 0,
+            canWrite: (ace.mask & 0x500d_0156) !== 0,
+        };
+    });
+    return { ok: true, entries, ...summarizeWindowsAcl(entries, { USERSID: owner.currentUserSid }) };
+}
+export async function inspectWindowsAcl(targetPath, opts) {
+    if (opts?.principalTranslationFailed) {
+        const error = new Error("Windows ACL principal SID translation failed");
+        return summarizeWindowsOwnerAcl({ error: String(error), errorCause: error });
+    }
+    if (hasWindowsPathAlias(targetPath, "filesystem", "win32")) {
+        const error = new Error("Path uses a Windows filesystem namespace alias");
+        return summarizeWindowsOwnerAcl({ error: String(error), errorCause: error });
+    }
+    let owner;
+    if (process.platform === "win32" && opts?.env === undefined && opts?.exec === undefined) {
+        try {
+            const native = getNativeBinding();
+            const stat = native && await safeStat(targetPath);
+            // Keep the named-query behavior for leaf links; the native reader follows them.
+            const facts = stat?.ok && !stat.isSymlink ? native?.readOwnerAndDacl(targetPath) : undefined;
+            if (facts && !facts.fallbackRequired && facts.isLocal && facts.aceListComplete && facts.unsupportedAceTypes.length === 0 &&
+                facts.aces.every(ace => ace.flags.inherited && ace.mask !== 0)) {
+                // .NET normalizes explicit ACEs, but retains nonzero inherited ACEs in
+                // their original order without merging them. Other forms keep its query.
+                // Adapt descriptor facts only: the public summary owns its SID and rights
+                // classification, which differs from the native secure-read policy.
+                owner = {
+                    daclPresent: facts.daclPresent,
+                    currentUserSid: facts.currentUserSid,
+                    aces: facts.aces.map(ace => ({
+                        sid: ace.sid,
+                        mask: ace.mask,
+                        deny: ace.aceType === "deny",
+                        inheritOnly: ace.flags.inheritOnly,
+                    })),
+                };
+            }
+        }
+        catch {
+            // Preserve this inspector's structured fallback and command diagnostics
+            // when the optional helper or native descriptor query is unavailable.
+        }
+    }
+    owner ??= await inspectWindowsOwner({ targetPath, env: opts?.env, exec: opts?.exec ?? defaultPermissionExec });
+    return summarizeWindowsOwnerAcl({
+        ...owner,
+        currentUserSid: normalizeSid(opts?.currentUserSid ?? "") || owner.currentUserSid,
+    });
+}
+export function formatWindowsAclSummary(summary) {
+    if (!summary.ok)
+        return "unknown";
+    const untrusted = [...summary.untrustedWorld, ...summary.untrustedGroup];
+    return untrusted.length === 0 ? "trusted-only" : untrusted.map((entry) => `${entry.principal}:${entry.rawRights}`).join(", ");
+}
+export function formatIcaclsResetCommand(targetPath, opts) {
+    const command = resolveWindowsSystemCommand("icacls.exe", opts.env);
+    const user = resolveWindowsUserPrincipal(opts.env, opts.userInfo) ?? "%USERNAME%";
+    const grant = opts.isDir ? "(OI)(CI)F" : "F";
+    return [command, `"${targetPath}"`, "/inheritance:r", "/grant:r", `"${user}:${grant}"`, "/grant:r", `"*S-1-5-18:${grant}"`].join(" ");
+}
+export function createIcaclsResetCommand(targetPath, opts) {
+    const user = resolveWindowsUserPrincipal(opts.env, opts.userInfo);
+    if (!user)
+        return null;
+    const grant = opts.isDir ? "(OI)(CI)F" : "F";
+    const args = [targetPath, "/inheritance:r", "/grant:r", `${user}:${grant}`, "/grant:r", `*S-1-5-18:${grant}`];
+    return { command: resolveWindowsSystemCommand("icacls.exe", opts.env), args, display: formatIcaclsResetCommand(targetPath, opts) };
+}

package/node_modules/@openclaw/fs-safe/dist/permissions.d.ts

@@ -0,0 +1,59 @@
+import type { PermissionCommandFailure } from "./permission-exec.js";
+import { type PermissionExec } from "./permissions-windows.js";
+export type { PermissionCommandFailure } from "./permission-exec.js";
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, } from "./permissions-windows.js";
+export type { IcaclsResetCommandOptions, PermissionExec, WindowsAclEntry, WindowsAclSummary, WindowsUserInfoProvider, } from "./permissions-windows.js";
+export type PermissionCheck = {
+    ok: boolean;
+    isSymlink: boolean;
+    isDir: boolean;
+    mode: number | null;
+    bits: number | null;
+    source: "posix" | "windows-acl" | "unknown";
+    worldWritable: boolean;
+    groupWritable: boolean;
+    worldReadable: boolean;
+    groupReadable: boolean;
+    /** Canonical Windows owner SID when the owner query succeeds. */
+    ownerSid?: string;
+    /** Whether the Windows owner is the current user, LocalSystem, or Administrators. */
+    ownerTrusted?: boolean;
+    /** Owner-query failure detail when Windows ownership could not be verified. */
+    ownerError?: string;
+    aclSummary?: string;
+    error?: string;
+    errorDetail?: PermissionCommandFailure;
+    /** Original inspection failure, retained separately from serializable diagnostics. */
+    errorCause?: unknown;
+};
+export type PermissionCheckOptions = {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    exec?: PermissionExec;
+};
+export type SafeStatResult = {
+    ok: boolean;
+    isSymlink: boolean;
+    isDir: boolean;
+    mode: number | null;
+    uid: number | null;
+    gid: number | null;
+    error?: string;
+};
+export declare function safeStat(targetPath: string): Promise<SafeStatResult>;
+export declare function inspectPathPermissions(targetPath: string, opts?: PermissionCheckOptions): Promise<PermissionCheck>;
+export declare function formatPermissionDetail(targetPath: string, perms: PermissionCheck): string;
+export declare function formatPermissionRemediation(params: {
+    targetPath: string;
+    perms: PermissionCheck;
+    isDir: boolean;
+    posixMode: number;
+    env?: NodeJS.ProcessEnv;
+}): string;
+export declare function modeBits(mode: number | null): number | null;
+export declare function formatOctal(bits: number | null): string;
+export declare function isWorldWritable(bits: number | null): boolean;
+export declare function isGroupWritable(bits: number | null): boolean;
+export declare function isWorldReadable(bits: number | null): boolean;
+export declare function isGroupReadable(bits: number | null): boolean;
+export declare function formatPosixMode(mode: number): string;

package/node_modules/@openclaw/fs-safe/dist/permissions.js

@@ -0,0 +1,132 @@
+import fsSync from "node:fs";
+import { formatIcaclsResetCommand, inspectWindowsPermissions, } from "./permissions-windows.js";
+import { hasWindowsPathAlias, pathForWindowsFilesystem, } from "./windows-path-alias.js";
+export { createIcaclsResetCommand, formatIcaclsResetCommand, formatWindowsAclSummary, inspectWindowsAcl, parseIcaclsOutput, resolveWindowsUserPrincipal, summarizeWindowsAcl, } from "./permissions-windows.js";
+function failedSafeStat(error) {
+    return {
+        ok: false,
+        isSymlink: false,
+        isDir: false,
+        mode: null,
+        uid: null,
+        gid: null,
+        error,
+    };
+}
+async function safeStatAdmitted(targetPath) {
+    try {
+        const lst = fsSync.lstatSync(pathForWindowsFilesystem(targetPath));
+        return {
+            ok: true,
+            isSymlink: lst.isSymbolicLink(),
+            isDir: lst.isDirectory(),
+            mode: typeof lst.mode === "number" ? lst.mode : null,
+            uid: typeof lst.uid === "number" ? lst.uid : null,
+            gid: typeof lst.gid === "number" ? lst.gid : null,
+        };
+    }
+    catch (err) {
+        return failedSafeStat(String(err));
+    }
+}
+export async function safeStat(targetPath) {
+    if (hasWindowsPathAlias(targetPath, "filesystem")) {
+        return failedSafeStat("Path uses a Windows filesystem namespace alias");
+    }
+    return await safeStatAdmitted(targetPath);
+}
+export async function inspectPathPermissions(targetPath, opts) {
+    const admissionPlatform = process.platform === "win32"
+        ? process.platform
+        : (opts?.platform ?? process.platform);
+    const st = hasWindowsPathAlias(targetPath, "filesystem", admissionPlatform)
+        ? failedSafeStat("Path uses a Windows filesystem namespace alias")
+        : await safeStatAdmitted(targetPath);
+    if (!st.ok) {
+        return {
+            ok: false,
+            isSymlink: false,
+            isDir: false,
+            mode: null,
+            bits: null,
+            source: "unknown",
+            worldWritable: false,
+            groupWritable: false,
+            worldReadable: false,
+            groupReadable: false,
+            error: st.error,
+        };
+    }
+    let effectiveMode = st.mode;
+    let effectiveIsDir = st.isDir;
+    if (st.isSymlink) {
+        try {
+            const target = fsSync.statSync(targetPath);
+            effectiveMode = typeof target.mode === "number" ? target.mode : st.mode;
+            effectiveIsDir = target.isDirectory();
+        }
+        catch {
+            // Keep lstat metadata when the symlink target cannot be inspected.
+        }
+    }
+    const bits = modeBits(effectiveMode);
+    const platform = opts?.platform ?? process.platform;
+    const windows = platform === "win32";
+    const permissions = {
+        ok: true,
+        isSymlink: st.isSymlink,
+        isDir: effectiveIsDir,
+        mode: effectiveMode,
+        bits,
+        source: windows ? "unknown" : "posix",
+        worldWritable: !windows && isWorldWritable(bits),
+        groupWritable: !windows && isGroupWritable(bits),
+        worldReadable: !windows && isWorldReadable(bits),
+        groupReadable: !windows && isGroupReadable(bits),
+    };
+    return windows ? await inspectWindowsPermissions(targetPath, permissions, opts) : permissions;
+}
+export function formatPermissionDetail(targetPath, perms) {
+    if (perms.source === "windows-acl") {
+        return `${targetPath} acl=${perms.aclSummary ?? "unknown"}`;
+    }
+    return `${targetPath} mode=${formatOctal(perms.bits)}`;
+}
+export function formatPermissionRemediation(params) {
+    if (params.perms.source === "windows-acl") {
+        return formatIcaclsResetCommand(params.targetPath, {
+            isDir: params.isDir,
+            env: params.env,
+        });
+    }
+    const optionSeparator = params.targetPath.startsWith("-") ? "-- " : "";
+    return (`chmod ${params.posixMode.toString(8).padStart(3, "0")} ${optionSeparator}` +
+        formatPosixShellArgument(params.targetPath));
+}
+function formatPosixShellArgument(value) {
+    if (value && /^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) {
+        return value;
+    }
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+export function modeBits(mode) {
+    return mode == null ? null : mode & 0o777;
+}
+export function formatOctal(bits) {
+    return bits == null ? "unknown" : bits.toString(8).padStart(3, "0");
+}
+export function isWorldWritable(bits) {
+    return bits != null && (bits & 0o002) !== 0;
+}
+export function isGroupWritable(bits) {
+    return bits != null && (bits & 0o020) !== 0;
+}
+export function isWorldReadable(bits) {
+    return bits != null && (bits & 0o004) !== 0;
+}
+export function isGroupReadable(bits) {
+    return bits != null && (bits & 0o040) !== 0;
+}
+export function formatPosixMode(mode) {
+    return (mode & 0o777).toString(8).padStart(3, "0");
+}

package/node_modules/@openclaw/fs-safe/dist/pinned-mutation-admission.d.ts

@@ -0,0 +1,24 @@
+import { type DenyMutationPolicy } from "./deny-mutations.js";
+import { type RootBoundaryIdentity } from "./root-boundary.js";
+import type { PinnedWriteMutationAdmission } from "./pinned-write-types.js";
+import type { MutationSymlinkPolicy } from "./root-symlink-policy.js";
+export type PinnedMutationPolicySnapshot = Readonly<{
+    denyMutations?: DenyMutationPolicy;
+    mutationSymlinks?: MutationSymlinkPolicy;
+}>;
+export declare function snapshotPinnedMutationPolicy(denyMutations: DenyMutationPolicy | undefined, mutationSymlinks: MutationSymlinkPolicy | undefined): PinnedMutationPolicySnapshot | undefined;
+export declare function preparePinnedWriteMutationAdmission(params: {
+    rootReal: string;
+    rootWithSep: string;
+    rootIdentity?: RootBoundaryIdentity;
+    resolvedTargetPath: string;
+    defaultRelativeParentPath: string;
+    originalPath?: string;
+    policy: PinnedMutationPolicySnapshot | undefined;
+    resolveCurrent(): Promise<{
+        resolved: string;
+    }>;
+}): Promise<{
+    relativeParentPath: string;
+    mutationAdmission?: PinnedWriteMutationAdmission;
+}>;