/**
 * Filesystem Policy Enforcer
 *
 * Implements filesystem isolation policies for sandboxed agent execution.
 * Supports overlay filesystems, mount namespaces, and access control.
 *
 * @packageDocumentation
 */
import { type FilesystemPolicy, type FilesystemActivityLog } from './types.js';
/**
 * Overlay filesystem configuration
 */
export interface OverlayMount {
    /** Lower layer (read-only base) */
    lowerDir: string;
    /** Upper layer (writes go here) */
    upperDir: string;
    /** Work directory for overlay operations */
    workDir: string;
    /** Final merged mount point */
    mergedDir: string;
}
/**
 * Access control entry
 */
export interface AccessControlEntry {
    /** Path pattern (glob-style) */
    path: string;
    /** Allowed operations */
    operations: ('read' | 'write' | 'execute' | 'delete')[];
    /** Allow or deny */
    effect: 'allow' | 'deny';
    /** Priority (higher = processed first) */
    priority: number;
}
/**
 * Filesystem mount state
 */
export interface MountState {
    sandboxId: string;
    policy: FilesystemPolicy;
    overlay: OverlayMount;
    mounts: ActiveMount[];
    quotaUsed: number;
    inodesUsed: number;
    accessControl: AccessControlEntry[];
}
/**
 * Active mount information
 */
export interface ActiveMount {
    source: string;
    target: string;
    readonly: boolean;
    type: string;
    mounted: boolean;
}
export declare class FilesystemPolicyEnforcer {
    private mounts;
    private activityLogs;
    constructor();
    /**
     * Initialize filesystem isolation for a sandbox
     */
    initializeFilesystem(sandboxId: string, policy: FilesystemPolicy): Promise<MountState>;
    /**
     * Cleanup filesystem mounts for a sandbox
     */
    cleanupFilesystem(sandboxId: string): Promise<void>;
    /**
     * Build access control rules from policy
     */
    private buildAccessControl;
    /**
     * Check if an operation is allowed
     */
    checkAccess(sandboxId: string, path: string, operation: 'read' | 'write' | 'execute' | 'delete'): {
        allowed: boolean;
        reason?: string;
    };
    /**
     * Normalize a filesystem path
     */
    private normalizePath;
    /**
     * Check if path matches a pattern
     */
    private pathMatches;
    /**
     * Check and update quota usage
     */
    checkQuota(sandboxId: string, bytesToWrite: number): {
        allowed: boolean;
        reason?: string;
    };
    /**
     * Update quota usage after write
     */
    updateQuota(sandboxId: string, bytesWritten: number, inodesUsed?: number): void;
    /**
     * Get current quota usage
     */
    getQuotaUsage(sandboxId: string): {
        bytesUsed: number;
        bytesLimit: number;
        inodesUsed: number;
        inodesLimit: number;
        percentUsed: number;
    } | null;
    /**
     * Log filesystem activity
     */
    logActivity(sandboxId: string, operation: 'read' | 'write' | 'delete' | 'create' | 'chmod', path: string, allowed: boolean, bytes?: number, blockedReason?: string): void;
    /**
     * Get activity logs for a sandbox
     */
    getActivityLogs(sandboxId: string): FilesystemActivityLog[];
    /**
     * Mount secrets for a sandbox
     */
    mountSecrets(sandboxId: string): Promise<void>;
    /**
     * Check if tier can access secrets
     */
    private canAccessSecrets;
    /**
     * Get filesystem statistics for a sandbox
     */
    getStats(sandboxId: string): {
        totalReads: number;
        totalWrites: number;
        totalBytesWritten: number;
        blockedOperations: number;
        mountCount: number;
    } | null;
}
export declare function createFilesystemPolicyEnforcer(): FilesystemPolicyEnforcer;
export declare function getFilesystemPolicyEnforcer(): FilesystemPolicyEnforcer;
//# sourceMappingURL=filesystem-policy.d.ts.map