/**
 * Sandboxed File System
 *
 * Provides a restricted file system wrapper that confines all operations
 * to a designated workspace directory. This prevents code execution from
 * accessing or modifying files outside the sandbox.
 *
 * Security Features:
 * - All paths resolved relative to sandbox root
 * - Path traversal attacks blocked (../, symlinks)
 * - Absolute paths outside sandbox rejected
 * - Only async operations exposed (no blocking)
 * - Symlink following disabled to prevent escapes
 *
 * @example
 * ```typescript
 * const sandboxedFs = createSandboxedFS('/home/user/.ncp/workspace');
 *
 * // These work (within sandbox):
 * await sandboxedFs.writeFile('output/report.pdf', data);
 * await sandboxedFs.readFile('data/input.json');
 *
 * // These are blocked (escape attempts):
 * await sandboxedFs.readFile('../config.json');     // Error!
 * await sandboxedFs.readFile('/etc/passwd');        // Error!
 * ```
 */
import * as fs from 'fs/promises';
import { ReadStream, WriteStream } from 'fs';
/**
 * Error thrown when a path violates sandbox boundaries
 */
export declare class SandboxEscapeError extends Error {
    readonly attemptedPath: string;
    readonly sandboxRoot: string;
    constructor(attemptedPath: string, sandboxRoot: string);
}
/**
 * Sandboxed file system interface
 * Mirrors Node.js fs/promises API but restricted to sandbox
 */
export interface SandboxedFS {
    readFile(filePath: string, encoding?: BufferEncoding): Promise<string | Buffer>;
    readdir(dirPath: string): Promise<string[]>;
    stat(filePath: string): Promise<fs.FileHandle extends infer T ? Awaited<ReturnType<typeof fs.stat>> : never>;
    exists(filePath: string): Promise<boolean>;
    writeFile(filePath: string, data: string | Buffer, encoding?: BufferEncoding): Promise<void>;
    appendFile(filePath: string, data: string | Buffer, encoding?: BufferEncoding): Promise<void>;
    mkdir(dirPath: string, options?: {
        recursive?: boolean;
    }): Promise<string | undefined>;
    unlink(filePath: string): Promise<void>;
    rmdir(dirPath: string, options?: {
        recursive?: boolean;
    }): Promise<void>;
    rm(filePath: string, options?: {
        recursive?: boolean;
        force?: boolean;
    }): Promise<void>;
    rename(oldPath: string, newPath: string): Promise<void>;
    copyFile(src: string, dest: string): Promise<void>;
    createReadStream(filePath: string): ReadStream;
    createWriteStream(filePath: string): WriteStream;
    getWorkspacePath(): string;
    resolvePath(relativePath: string): string;
}
/**
 * Create a sandboxed file system restricted to the given root directory
 *
 * @param sandboxRoot - Absolute path to the sandbox root directory
 * @returns SandboxedFS instance with all operations confined to sandboxRoot
 */
export declare function createSandboxedFS(sandboxRoot: string): SandboxedFS;
/**
 * Default workspace subdirectory name within .ncp
 */
export declare const WORKSPACE_DIR_NAME = "workspace";
/**
 * Get the default workspace path for a given NCP directory
 *
 * @param ncpDir - Path to the .ncp directory
 * @returns Path to the workspace directory
 */
export declare function getWorkspacePath(ncpDir: string): string;
//# sourceMappingURL=sandboxed-fs.d.ts.map