/** Current configured file-sandbox flag for a bot. */
export declare function getBotSandbox(larkAppId: string): boolean;
export declare function updateBotSandbox(larkAppId: string, enabled: boolean): Promise<{
    ok: true;
    sandbox: boolean;
} | {
    ok: false;
    reason: string;
}>;
/** Current configured read-isolation flag for a bot. */
export declare function getBotReadIsolation(larkAppId: string): boolean;
/** Publish only the daemon's live spawn view (in-memory `botCfg.readIsolation`)
 * without touching bots.json. Split out from {@link persistBotReadIsolation} so
 * a future fence-then-publish caller can order the durable write and the
 * worker-admission view independently — e.g. to close the window where a cold
 * refork consumes a transient value while bots.json is rolled back after a
 * Codex App ownership conflict. No caller stages the two halves yet;
 * {@link updateBotReadIsolation} composes them in the usual persist→publish
 * order, so today this only ever runs after a successful persist. */
export declare function setBotReadIsolationRuntime(larkAppId: string, enabled: boolean): void;
/** Persist the desired flag to bots.json without publishing it to the live
 * worker-admission view yet (see {@link setBotReadIsolationRuntime} for that
 * half). Split from {@link updateBotReadIsolation} so a future caller can fence
 * old generations between the durable write and the spawn-view publish; no
 * caller stages the two halves today, so this runs as the first step of the
 * composed {@link updateBotReadIsolation}. */
export declare function persistBotReadIsolation(larkAppId: string, enabled: boolean): Promise<{
    ok: true;
    readIsolation: boolean;
} | {
    ok: false;
    reason: string;
}>;
/** Per-bot read-isolation toggle (macOS Seatbelt read-deny). Same persistence
 *  contract as {@link updateBotSandbox}: atomic bots.json write + in-memory sync,
 *  so the next session spawn reads `botCfg.readIsolation` without a daemon restart. */
export declare function updateBotReadIsolation(larkAppId: string, enabled: boolean): Promise<{
    ok: true;
    readIsolation: boolean;
} | {
    ok: false;
    reason: string;
}>;
/** The three-tier sandbox path lists a bot may declare (highest-precedence
 *  layer of the FsPolicy). Empty/absent tiers fall back to deny-by-default. */
export interface SandboxPathTiers {
    readWrite?: string[];
    readOnly?: string[];
    deny?: string[];
}
/** Current configured sandboxPaths for a bot (undefined = none set). */
export declare function getBotSandboxPaths(larkAppId: string): SandboxPathTiers | undefined;
/** Normalize a three-tier sandboxPaths object for storage: per-tier trim/dedup,
 *  then CROSS-TIER dedup resolving a path listed in >1 tier to the MORE
 *  RESTRICTIVE tier (deny > readOnly > readWrite) — matching fs-policy's
 *  mergeFsRules same-source tie-break, so what's stored matches what the sandbox
 *  (and the dashboard UI/tester) resolve. Returns `{}` when every tier is empty
 *  (caller treats that as "clear the field"). Pure — unit-tested directly. */
export declare function normalizeSandboxPaths(tiers: SandboxPathTiers): SandboxPathTiers;
/** Per-bot sandboxPaths (readWrite/readOnly/deny) persistence. Same contract as
 *  {@link updateBotSandbox}: atomic bots.json write + in-memory sync, so the next
 *  session spawn reads `botCfg.sandboxPaths` without a daemon restart. Passing an
 *  all-empty tiers object CLEARS the field (bots.json stays clean → pure
 *  deny-by-default baseline). */
export declare function updateBotSandboxPaths(larkAppId: string, tiers: SandboxPathTiers): Promise<{
    ok: true;
    sandboxPaths?: SandboxPathTiers;
} | {
    ok: false;
    reason: string;
}>;
//# sourceMappingURL=sandbox-store.d.ts.map