import { isGlobScope } from '../policy-scopes.js';
export declare const isGlob: typeof isGlobScope;
/** `a/./b/` becomes `a/b`; the empty string and `./` become `.`. */
export declare function norm(p: string): string;
/** `a` is `b` or an ancestor of `b` (a grant or deny of `a` covers `b`); undefined when undecidable. */
export declare function covers(a: string, b: string, orgRoot?: string): boolean | undefined;
/** `a` and `b` are the same path or one lies inside the other; undefined when undecidable. */
export declare function overlaps(a: string, b: string, orgRoot?: string): boolean | undefined;
/** The directory part of an entry before its first wildcard segment (`src/**` gives `src`). */
export declare function literalBase(entry: string): string;
/**
 * Does the scope entry `w` (a `writes` glob or directory) cover every path the entry `e` can name?
 * Conservative, by instantiation, not a proof: a plain path `e` is a directory grant in `policy.ts` (the
 * path and everything beneath it), so it is covered only when `w` covers a deep path beneath it; name a
 * single file by listing it as the glob itself. `w` that is a plain directory covers whatever lies lexically
 * under it.
 */
export declare function scopeCovers(w: string, e: string): boolean;
/** Is the workspace-relative path `rel` inside any entry of `scope`? (Plain entry: a directory grant.) */
export declare function pathInScope(scope: string[], rel: string): boolean;
export type WorkspaceMode = 'repo' | 'isolated' | 'worktree' | 'worktree-per-role' | 'path';
export interface WorkspaceInfo {
    mode: WorkspaceMode;
    /** Roles with the same key share one directory. */
    key: string;
    /** The workspace as a sandbox entry: `.` for the project root, a path under the org root, or as given. */
    entry: string;
    /** False only for `worktree-per-role` (each role has its own tree). */
    shared: boolean;
}
interface WsDef {
    name?: string;
    run_config?: Record<string, unknown>;
}
/** `run_config.workspace` as the daemon reads it (`daemon.workspaceSetting`), without the project root. */
export declare function workspaceInfo(def: WsDef, roleId?: string): WorkspaceInfo;
/** Does a `policy.sandbox.denyWrite` entry cover the workspace? Undecidable counts as no. */
export declare function denyCoversWorkspace(deny: string, ws: WorkspaceInfo, orgRoot?: string): boolean;
/** Would a `policy.sandbox.allowWrite` entry make any part of the workspace writable? Undecidable counts as no. */
export declare function allowReachesWorkspace(allow: string, ws: WorkspaceInfo, orgRoot?: string): boolean;
/**
 * Would a `fileWrite` entry grant a write inside the workspace? A relative entry is relative to the
 * workspace itself, so it always does (unless it climbs out of it); an absolute one when it overlaps.
 */
export declare function fileScopeReachesWorkspace(entry: string, ws: WorkspaceInfo, orgRoot?: string): boolean;
export {};
//# sourceMappingURL=writer-paths.d.ts.map