import type { CapabilityPolicy } from './policy.js';
import type { SandboxEnv } from './sandbox.js';
import type { ToolCall } from './tools.js';
/**
 * Wrap a `SandboxEnv` with `CapabilityPolicy` enforcement at the sandbox layer.
 *
 * Without this decorator, agent code that calls `(await session.sandbox).exec(...)`
 * directly bypasses the policy that `session.shell()` and tool dispatch enforce.
 * `policiedSandboxEnv()` closes that gap by re-running the same policy
 * evaluation against `exec` / `readFile` / `writeFile` / `mkdir` / `rm` / etc.
 *
 * Throws `FabricError`:
 *   - `COMMAND_DENIED` when an exec is denied or requires approval.
 *   - `POLICY_DENIED`  when a filesystem op is denied or requires approval.
 *
 * The decorator does NOT auto-resolve `requireApproval` patterns — the
 * sandbox layer has no session context to gate approvals against. Callers
 * who want approval gating should go through `session.shell()` /
 * `session.prompt()` with tool calls, where the full approval machinery
 * (callbacks, store-backed waiting, escalation) is wired up.
 *
 * Pass-through: `snapshot`, `restore`, `fork`, `suspend`, `resume`, `cleanup`.
 */
export declare function policiedSandboxEnv(inner: SandboxEnv, policy: CapabilityPolicy | undefined): SandboxEnv;
/** @internal Run one approved tool operation through the sandbox policy layer. */
export declare function runWithSandboxPolicyApproval<T>(sandbox: SandboxEnv, call: ToolCall, operation: () => Promise<T>): Promise<T>;
//# sourceMappingURL=policied-sandbox.d.ts.map