import type { RuntimeContext } from "../runtime/state/context.js";
/** A directory of `.agency` modules the host vouches for, and the directory
 *  their compiled JavaScript is in. As written in config they may be
 *  relative; once resolved they are absolute real paths. */
export type TrustedModules = {
    source: string;
    compiled: string;
};
export type ResolvedTrustedModules = {
    ok: true;
    value: TrustedModules[];
} | {
    ok: false;
    error: string;
};
/** Resolve each entry's paths against `baseDir` to real paths. A directory
 *  that does not exist, or is reached through a symlink, fails with the
 *  entry as written and the path it resolved to. */
export declare function resolveTrustedModules(entries: TrustedModules[], baseDir: string): ResolvedTrustedModules;
/** The entry under whose `source` the real path `file` sits, or null. */
export declare function trustedEntryFor(file: string, entries: TrustedModules[]): TrustedModules | null;
/** The compiled file for a trusted `.agency` source: `source` swapped for
 *  `compiled`, `.agency` swapped for `.js`. */
export declare function compiledPathFor(file: string, entry: TrustedModules): string;
/** The list this process may hand to the sandbox: in a subprocess, what
 *  the bootstrap seeded from the parent; at the root, the context's config
 *  list resolved against the working directory. A config entry that does
 *  not resolve throws, naming the entry. See docs/dev/runtime/trusted-modules.md.
 *  Nothing reads `sandbox.trustedModules` any other way. */
export declare function effectiveTrustedModules(ctx: RuntimeContext<any>): TrustedModules[];
/** The inverse of compiledPathFor, for a path a compiled module records
 *  for its own source: under an entry's `compiled` directory, the same
 *  relative path under its `source` directory. Any other path is returned
 *  as it is. */
export declare function sourcePathFor(file: string, entries: TrustedModules[]): string;