import { type IsolationConfig, type ResolvedIsolation, type WrapContext } from './types.js';
/** A mount that the forbidden-path policy refuses. Raised before any launch. */
export declare class IsolationPolicyError extends Error {
    constructor(message: string);
}
/**
 * Resolve a path to its canonical form, following symlinks as far as the
 * filesystem allows and normalising the rest. Without this, `~/link-to-ssh`
 * and `/home/u/.ssh` are different strings for the same directory, and a
 * string comparison against the forbidden list is trivially side-stepped.
 */
export declare function canonicalPath(p: string): string;
/**
 * How a canonical mount path collides with a canonical forbidden path.
 *
 * `parent` matters as much as the other two: binding `$HOME` does not name
 * `~/.ssh`, but it exposes it just as completely.
 */
export declare function mountConflict(mount: string, forbidden: string): 'exact' | 'descendant' | 'parent' | null;
/**
 * Validate a raw `isolation:` block. Returns a list of human-readable problems
 * (empty ⇒ valid). Pure; callable from config.ts like adapter.validateOptions.
 */
export declare function validateIsolationConfig(raw: unknown): string[];
/**
 * Where a role's per-role harness runtime state lives. Under the agent's
 * own state directory, so it is covered by the state dir's existing lifecycle
 * and by the forbidden-path exception, and is never shared with a peer.
 */
export declare const harnessRuntimeDir: (stateDir: string, harnessId: string) => string;
/**
 * Resolve a raw (already validated) isolation block against runtime context into
 * a defaults-filled, backend-agnostic policy, and REFUSE any mount that would
 * breach the forbidden-path list.
 *
 * The mount model is an allowlist: only the durable set (state dir, cwd, harness
 * config, declared fs/secrets) plus read-only system dirs are exposed. The
 * forbidden list — the ours key store, sibling agent state dirs, ~/.ssh, ~/.aws
 * — is now enforced on top of that, so a role cannot ask its way back in.
 *
 * Not pure: canonicalising a path reads the filesystem, because symlink aliases
 * are one of the ways a forbidden path gets requested. Throws
 * `IsolationPolicyError`; callers surface it against the role.
 */
export declare function resolveIsolation(cfg: IsolationConfig, ctx: WrapContext): ResolvedIsolation;
export type { IsolationConfig };