import type { PermissionLevel } from "../security/permission-level.js";
/**
 * Workspace root files that only owners and admins may write.
 * Regular users (permissionLevel === "user") are blocked from modifying these.
 */
export declare const WORKSPACE_ROOT_PROTECTED_FILES: Set<string>;
/**
 * Returns true if the resolved path points to a protected workspace root file.
 */
export declare function isWorkspaceRootProtectedFile(resolvedPath: string, workspaceRoot: string): boolean;
/**
 * Throws if a write to `resolvedPath` is not permitted for the given permission level.
 * Protected workspace root files require owner or admin access.
 */
export declare function assertWorkspaceWritePermission(params: {
    resolvedPath: string;
    workspaceRoot: string;
    permissionLevel: PermissionLevel | undefined;
}): void;
export declare function resolveSandboxInputPath(filePath: string, cwd: string): string;
export declare function resolveSandboxPath(params: {
    filePath: string;
    cwd: string;
    root: string;
}): {
    resolved: string;
    relative: string;
};
export declare function assertSandboxPath(params: {
    filePath: string;
    cwd: string;
    root: string;
    allowFinalSymlink?: boolean;
}): Promise<{
    resolved: string;
    relative: string;
}>;
export declare function assertMediaNotDataUrl(media: string): void;
export declare function resolveSandboxedMediaSource(params: {
    media: string;
    sandboxRoot: string;
}): Promise<string>;
