/**
 * Durable Mission Graph — repository identity, worktree allocation and
 * isolation (2.0.0).
 *
 * Repository identity is authoritative: allocations bind to a canonical repo
 * id, never to a label. Worktrees are allocated with explicit isolation and
 * must not escape the repository root (symlink / Windows junction escape is
 * rejected). The operator's own worktree is never allocated to a mission.
 */
import type { MissionOperationResult, RepositoryIdentity, RepositoryIdentityScheme, WorktreeAllocation } from "./types.js";
/**
 * Normalize a raw remote/URL into a canonical repository identity.
 * Lowercases, strips credentials, trims trailing slashes and `.git`, and
 * prefers the SSH-style host key when present.
 */
export declare function canonicalRepositoryId(raw: string, scheme?: RepositoryIdentityScheme): string;
export declare function parseRepositoryIdentity(identity: string): RepositoryIdentity | undefined;
export declare function sameRepositoryIdentity(a: string, b: string): boolean;
/**
 * Determine whether a candidate worktree path escapes a repository root via a
 * symlink or (on Windows) a junction. Because `path.resolve` is purely lexical,
 * we conservatively reject any candidate path that resolves outside the root
 * directory, and reject paths containing path separators where the "worktree"
 * is expected to be a direct child of a root (isolation boundary).
 */
export declare function assertIsolationBoundary(root: string, worktreePath: string): boolean;
/** Check that a worktree path does not traverse a symlink/junction segment of root. */
export declare function blocksEscalatingSegments(root: string, worktreePath: string): boolean;
export interface WorktreeAllocationInput {
    repositoryId: string;
    root: string;
    worktreePath: string;
    /** The operator's own worktree base path, which must never be allocated. */
    operatorWorktree: string;
}
/**
 * Allocate a worktree record for a repository.
 * Rejects when the path is not within the root, when it equals the operator's
 * worktree, or when it violates the isolation boundary.
 */
export declare function allocateWorktree(input: WorktreeAllocationInput, nowMs?: number): MissionOperationResult<WorktreeAllocation>;
/**
 * Detect whether an environment observation deviates from the declared scope.
 * Returns the set of observed repository identities not declared in the scope.
 */
export declare function detectRepositoryDrift(declared: string[], observed: string[]): string[];
/** Whether an observed repository is permitted by the declared scope. */
export declare function isRepositoryDeclared(declared: string[], observed: string): boolean;
//# sourceMappingURL=repository.d.ts.map