import type { OrgBus } from './bus.js';
export interface DenyExecCtx {
    home: string;
    env: NodeJS.ProcessEnv;
    /** Override the system bin directories (tests). */
    systemDirs?: string[];
}
/** The real paths of every executable file `patterns` name: bare names (`*` globs) wherever the
 *  resolver looks, absolute paths as themselves. A symlink is followed; its target is masked only
 *  when the target's own name matches too (so a version manager's shim, which points at the manager,
 *  is left alone: it ends in the masked interpreter). The running node is always among them when its
 *  name matches. */
export declare function resolveDenyExec(patterns: string[], ctx: DenyExecCtx): string[];
/** A complete mask for `patterns`: the whole filesystem as it is, minus those programs. */
export declare function denyExecMask(patterns: string[], ctx: DenyExecCtx): string[];
/** The mask a session launches its runner in: `authorityMask` (undefined when the role has none)
 *  plus the denyExec layer and the home write-deny layer (home-write-deny.ts). Unchanged without
 *  `denyExec`, `denyRead` or `homeWriteAllow`. Throws when the role asks for one of them and
 *  bubblewrap cannot do it: a role must not start with the program reachable or the home open. */
export declare function roleExecMask(args: {
    bus: OrgBus;
    roleId: string;
    authorityMask: string[] | undefined;
    denyExec?: string[];
    denyRead?: string[];
    /** Directories the daemon itself wants unreadable (GA row R3: other roles' mail digests). Unlike
     *  `denyRead`, bubblewrap being unavailable does not refuse the role: the audit
     *  `mail-mask-unavailable` is raised and the file-tool and SDK-sandbox layers still apply. */
    bestEffortDenyRead?: string[];
    /** Directories to bind read-only for every role (GA row R4: the mail root). Best-effort like `bestEffortDenyRead`. */
    bestEffortReadOnly?: string[];
    /** Private host directories to bind over the runner's native copy directories (GA row R5). Best-effort and audited like the lists above; a destination that does not exist is skipped. */
    bestEffortBinds?: {
        src: string;
        dest: string;
    }[];
    /** `policy.sandbox.homeWriteAllow`: set (even empty) to make the real home unwritable apart from these. */
    homeWriteAllow?: string[];
    /** Paths that must stay writable if they are under the home (cwd, org root, allowWrite, tmp). */
    writableRoots?: Array<string | undefined>;
    home: string;
    env: NodeJS.ProcessEnv;
    availability?: {
        available: boolean;
        reason?: string;
    };
    homeAvailability?: {
        available: boolean;
        reason?: string;
    };
}): string[] | undefined;
/** Why a Bash command must not run because it names a program denied by `policy.sandbox.denyExec`
 *  in a command position, or undefined. Fails closed on a command position it cannot read. */
export declare function execDenyViolation(cmd: string, patterns: string[] | undefined): string | undefined;
//# sourceMappingURL=exec-deny.d.ts.map