export interface SealedPathInfo {
    sealed: true;
    sealId: string;
    sealedRoot: string;
    canonicalPath: string;
}
export type PathSealClassification = SealedPathInfo | {
    sealed: false;
};
/**
 * A public Nebula API attempted to mutate immutable replay evidence.
 * ReplaySealService intentionally writes with node:fs and does not cross this
 * public mutation boundary.
 */
export declare class SealedPathLockedError extends Error {
    readonly name = "SealedPathLockedError";
    readonly code = "sealed_read_only";
    readonly statusCode = 403;
    readonly sealId: string;
    readonly lockedPath: string;
    constructor(info: SealedPathInfo, operation?: string);
}
/**
 * Derive sealed state from the filesystem path, never from caller-supplied UI
 * mode. Both the lexical path and its resolved target are checked: a symlink
 * cannot smuggle a write into a seal, while a symlink inside a seal cannot
 * make its lexical entry mutable.
 */
export declare function classifySealedPath(filePath: string): PathSealClassification;
/** Find a seal that a recursive delete/rename of `directory` would destroy. */
export declare function findSealedDescendant(directory: string): SealedPathInfo | null;
export declare function assertPathMutable(filePath: string, options?: {
    operation?: string;
    protectDescendants?: boolean;
}): void;
export declare function sealedErrorBody(error: SealedPathLockedError): {
    code: string;
    detail: string;
    seal_id: string;
    path: string;
};