/*
    * ProtectedPaths.hpp
    * Capability required to modify paths on the booted system volume
    * Copyright (c) 2026 Daniel Hammer
*/

#pragma once
#include <cstdint>

namespace Fs {

    // Capability a process must hold to create, write, delete, rename or
    // re-timestamp `path`. Returns 0 when the path is unprotected.
    uint64_t RequiredFileWriteCapability(const char* path);

    // True for an installed program image: one on the system volume that
    // cannot be replaced without CAP_SYSTEM_IMAGE (0:/os, 0:/apps). Only such
    // an image is identified by its path well enough to carry a grant.
    bool IsSystemImage(const char* path);

    // Log the rule table at boot, so a path that should be protected and is
    // not is visible rather than silently missing.
    void LogProtectedPaths();

}