import type { PostSynthDiagnostic } from "../../lint/post-synth.js";
import { type EncodablePolicyBuildResult } from "./policy-wire.js";
export interface SandboxPolicyResult {
    /** What the policy pack reported — plain data, validated inside the child before it crossed (see `./policy-wire.ts`'s `scanPolicyDiagnostics`). */
    diagnostics: PostSynthDiagnostic[];
    /** esbuild bundling wall-clock time. */
    bundleMs: number;
    /** Bundle size in bytes. */
    bundleBytes: number;
    /** Encoded build-result payload size in bytes — what crossed the IPC channel. */
    payloadBytes: number;
}
export interface SandboxPolicyOptions {
    /** Absolute paths to the project's `lint.policies` modules, in declaration order. */
    policyPaths: readonly string[];
    /** The merged, serialized build result the checks run over. */
    buildResult: EncodablePolicyBuildResult;
    /** The environment/stack this build was evaluated for (`--env`, else `ownership.env`) — becomes `ctx.env`. */
    env?: string;
    /** Directory the child is granted `--allow-fs-read` for: the project root (the `chant.config.*` directory, which `lint.policies` paths are resolved against). */
    projectRoot: string;
}
/**
 * Evaluate `policyPaths` against `buildResult` inside a sandboxed child.
 *
 * Throws — rather than degrading to an in-process run — when the policies
 * cannot be evaluated inside the boundary or their diagnostics cannot cross it
 * as JSON. Under `--sandbox` a policy pack that "almost" ran is not a safe
 * thing to proceed with, and quietly falling back would give away the property
 * the flag exists to provide.
 */
export declare function runPoliciesSandboxed(options: SandboxPolicyOptions): Promise<SandboxPolicyResult>;
//# sourceMappingURL=policy-run.d.ts.map