import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
/** Child write confinement passed by the parent as PI_FABRIC_WRITE_POLICY. */
export interface FabricWritePolicy {
    readOnly: boolean;
    /** Canonical absolute roots; empty with readOnly. */
    writableRoots: string[];
    shell: "deny" | "unconfined";
}
/** Malformed policy text fails closed to read-only with shell denied. */
export declare const readWritePolicy: (raw?: string | undefined) => FabricWritePolicy | undefined;
export declare const isInside: (root: string, target: string) => boolean;
/** Return a refusal reason, or undefined when the policy allows the call. */
export declare const writePolicyDenial: (policy: FabricWritePolicy, toolName: string, input: unknown, cwd: string) => string | undefined;
/** Child-side guard loaded by the worker with -e only when a policy is set. */
export default function fabricWriteGuard(pi: ExtensionAPI): void;
//# sourceMappingURL=write-guard.d.ts.map