import type { ToolSession } from "./index.js";
/** True when `targetPath` resolves into the session-local artifact sandbox.
 *  Routes through {@link resolvePlanPath} so the guard and the eventual write
 *  always agree on the absolute target (including bracketed hashline headers,
 *  internal URLs, and bare absolute paths). Files inside the sandbox are not
 *  part of the working tree, so plan mode treats them as freely writable
 *  scratch/plan space — and tag-based path recovery may rebind onto them. */
export declare function targetsLocalSandbox(session: ToolSession, targetPath: string, signal?: AbortSignal): Promise<boolean>;
/**
 * Resolve a write/edit target to its absolute filesystem path. Internal URLs
 * locate through their scheme handler (the entry need not exist yet); URLs no
 * local file backs throw the router's uniform error. Plain paths resolve
 * against the session cwd. Bracketed hashline headers (`[path#TAG]`) are
 * unwrapped first so the inner filesystem path drives resolution — keeping the
 * plan-mode guard and the eventual write in lockstep. Locating uses the session's
 * read context (same `local://` mapping), and `signal` aborts a vault root lookup.
 */
export declare function resolvePlanPath(session: ToolSession, targetPath: string, signal?: AbortSignal): Promise<string>;
/**
 * Plan mode keeps the working tree read-only while letting the agent draft its
 * plan. Writes and edits to the `local://` artifact sandbox are allowed (that is
 * where the plan and any scratch notes live); anything that would touch the
 * working tree — or rename/delete a file — is rejected.
 */
export declare function enforcePlanModeWrite(session: ToolSession, targetPath: string, options?: {
    move?: string;
    op?: "create" | "update" | "delete";
    signal?: AbortSignal;
}): Promise<void>;