/**
 * Project the host's filesystem policy into a adapter's own vendor sandbox
 * (ADR 0039).
 *
 * Harnery decides where a workflow child may write. Until this existed it never
 * told the child, so a child working in a provider-owned Git worktree could
 * edit files and could not commit: the vendor excludes a repository's
 * administrative directory from its writable set by policy, and Harnery had no
 * way to name it as an exception.
 *
 * The one rule that matters here is that a projection an adapter cannot
 * represent is refused before launch. Passing a policy that gets silently
 * dropped would leave an operator believing a child was constrained when it was
 * not, which is worse than refusing and worse than never offering the feature.
 */
import type { AdapterSandboxProjection } from "../adapters/types.js";
import type { GitAdministrativeGrant, SpawnFilesystemPolicy } from "./types.js";
import type { WorkspaceBinding } from "./workspaces/types.js";
export declare class SandboxProjectionError extends Error {
    readonly adapter: string;
    readonly reason: "mode_unrepresentable" | "writable_roots_unrepresentable" | "no_projection" | "writable_root_escapes_workspace" | "git_grant_unavailable";
    constructor(adapter: string, reason: SandboxProjectionError["reason"], message: string);
}
export interface ResolvedSandboxProjection {
    /** Vendor-native name for the requested mode. */
    nativeMode: string;
    writableRoots: readonly string[];
}
/**
 * Resolve a requested policy against what the adapter declares it can carry.
 * Throws rather than degrading; see the module note.
 */
export declare function resolveSandboxProjection(adapter: string, declaration: AdapterSandboxProjection | undefined, policy: SpawnFilesystemPolicy): ResolvedSandboxProjection;
/**
 * Refuse a projection that would grant write access outside the root the
 * workspace provider already validated (ADR 0039).
 *
 * The renderer alone cannot do this: it never sees the binding. Granting a path
 * the provider never sanctioned would let a projection quietly widen the blast
 * radius of a run that the workspace lifecycle believes it has contained.
 */
export declare function assertProjectionWithinWorkspace(adapter: string, allowedRootRealpath: string, writableRoots: readonly string[]): void;
/**
 * Resolve a named Git administrative grant into concrete writable roots
 * (ADR 0040).
 *
 * These are the only paths a run may write outside its workspace, and the
 * caller never names them: they come from the binding the provider verified.
 * A caller-supplied path is checked by `assertProjectionWithinWorkspace` and can
 * never reach here, so asking for the grant is the whole of the widening.
 *
 * In a linked worktree both halves of the administrative directory live under
 * the source repository, and a commit needs the shared half regardless, so the
 * grant returns both rather than pretending the private half is useful alone.
 */
export declare function resolveGitGrantRoots(grant: GitAdministrativeGrant, binding: WorkspaceBinding | undefined): readonly string[];
//# sourceMappingURL=sandbox-projection.d.ts.map