/**
 * Pure translation from resolved sandbox policy + derived path planes to the
 * srt settings document the child launcher feeds to SandboxManager.initialize.
 *
 * Host-neutral and side-effect free: no srt import (the settings shape is
 * asserted against the exact-pinned srt 0.0.66 by compatibility tests), no
 * secrets (paths and domains only).
 */
import type { ResolvedSandboxPolicy, SandboxNetworkMode, SandboxPathSet } from "#src/sandbox/types";
/**
 * srt network settings. The `allowedDomains` OMISSION is load-bearing:
 * srt 0.0.66 computes `hasNetworkConfig = network?.allowedDomains !== undefined`
 * — omitting the property keeps host networking with no netns/proxy, while
 * `[]` activates the isolated netns+proxy path blocking all egress (see
 * docs/research/sandbox-srt-per-spawn-launcher-spike.md §3). Only the library
 * API can express the omission; the CLI schema requires the field.
 */
export interface SrtNetworkSettings {
    allowedDomains?: string[];
    deniedDomains: string[];
    strictAllowlist?: boolean;
}
export interface SrtFilesystemSettings {
    denyRead: string[];
    allowRead?: string[];
    allowWrite: string[];
    denyWrite: string[];
}
export interface SrtSettings {
    network: SrtNetworkSettings;
    filesystem: SrtFilesystemSettings;
}
/**
 * Translate the resolved network policy (D7).
 *
 * | mode           | translation                                | consequence           |
 * |----------------|--------------------------------------------|-----------------------|
 * | default: allow | omit allowedDomains; deniedDomains: []     | host network          |
 * | default: deny  | allowedDomains+deniedDomains, strict, no ask | netns + proxy       |
 *
 * Validation (section 2) guarantees default-allow has empty domain arrays —
 * srt cannot enforce a selective deny on its no-proxy path, so accepting one
 * here would lie. Deny matches win inside srt's proxy.
 */
export declare function buildSrtNetworkSettings(policy: ResolvedSandboxPolicy): SrtNetworkSettings;
/**
 * Translate the two path planes to srt's read-only-root model (D6).
 *
 * srt starts from `--ro-bind / /`: reads are broadly available unless masked,
 * writes are the scarce grant. `read` is therefore a narrow re-allow inside a
 * denied region — never a global read allowlist. Mandatory security denies
 * ride the same srt arrays as user denies; the contradictory-policy check
 * (user deny over mandatory plumbing) happens in core BEFORE translation.
 */
export declare function buildSrtFilesystemSettings(userPaths: SandboxPathSet, mandatoryPaths: SandboxPathSet): SrtFilesystemSettings;
export declare function buildSrtSettings(policy: ResolvedSandboxPolicy, userPaths: SandboxPathSet, mandatoryPaths: SandboxPathSet): SrtSettings;
/** The enforced network boundary implied by a resolved policy (audit fact). */
export declare function networkModeFor(policy: ResolvedSandboxPolicy): SandboxNetworkMode;
//# sourceMappingURL=srt-settings.d.ts.map