import { type ConfigModuleNamespace } from "./config-import.js";
/**
 * Arm sandboxed config evaluation for the rest of this process. Called from
 * `../cli/main.ts` immediately after `parseArgs`, when `--sandbox` was passed
 * — before the first config load. Idempotent; there is deliberately no
 * disarm, because a security mode that can be turned off partway through a
 * process is not one.
 */
export declare function armSandboxConfigEvaluation(): void;
/** Whether {@link armSandboxConfigEvaluation} has been called. */
export declare function isSandboxConfigEvaluationArmed(): boolean;
/**
 * Test-only reset. Vitest gives each test file its own module registry, so
 * this exists for suites that arm and disarm within one file.
 */
export declare function resetSandboxConfigEvaluationForTests(): void;
/**
 * The export a config module's configuration lives on: an explicit `default`,
 * a named `config`, else the module namespace itself (a config authored as a
 * set of top-level named exports). Applied identically on both sides of the
 * boundary — in the child by `./discovery/sandbox/driver.ts`'s config driver,
 * here for the in-process path — so `--sandbox` changes only where the file is
 * evaluated, never how its result is read.
 */
export declare function selectConfigExport(namespace: ConfigModuleNamespace): unknown;
/**
 * Evaluate a project's `chant.config.ts` and return its configuration object,
 * pre-`normalizeConfig`. Sandboxed when armed, in-process otherwise.
 *
 * @param configPath - Absolute path to the config file.
 * @param projectRoot - Directory to grant the sandboxed child read access to;
 *   defaults to the config file's own directory.
 */
export declare function evaluateProjectConfig(configPath: string, projectRoot?: string): Promise<unknown>;
/**
 * Synchronous counterpart for `./lint/config.ts`'s `loadConfig` (`chant lint`
 * is a sync pipeline and predates the async loader).
 *
 * When armed, this cannot spawn a child — so it uses the result of an earlier
 * armed load of the same file, and refuses if there isn't one. In practice
 * there always is: `../cli/main.ts` loads the project config before dispatching
 * to any command. Refusing rather than falling back to an in-process `require`
 * is the point — a sync call site is exactly where a boundary would otherwise
 * be lost by accident.
 */
export declare function evaluateProjectConfigSync(configPath: string, dir: string): unknown;
//# sourceMappingURL=config-sandbox.d.ts.map