import { type Entry, type Mount, type TypedMount } from './entries';
import { Manifest } from './manifest';
export declare const REDACTED_MOUNT_CREDENTIAL_PATHS_KEY = "__openaiAgentsRedactedMountCredentialPaths";
export declare const NON_RESUMABLE_MOUNT_AUTHORITY_KEY = "__openaiAgentsNonResumableMountAuthority";
export type MountCredentialFileReference = {
    field: string;
    path: string;
};
export type EffectiveManifestEntryPath = {
    path: string;
    recursive: boolean;
};
export type MountCredentialExposureDecision = {
    credentialExposureAcknowledged: boolean;
    broadCredentialExposureAcknowledged: boolean;
};
export declare function isMountCredentialFileEnvironmentName(name: string): boolean;
export declare function markSandboxSessionStateUnsafe(state: object): void;
export declare function isSandboxSessionStateUnsafe(state: object): boolean;
export declare function assertSandboxSessionStateUsable(state: object): void;
export declare function withExclusiveSandboxManifestMutation<T>(state: object, operation: () => Promise<T>): Promise<T>;
export declare function withExclusiveSandboxStateInspection<T>(state: object, operation: () => Promise<T>): Promise<T>;
export declare function captureSandboxStateGeneration(state: object): number;
export declare function assertSandboxStateGenerationUnchanged(state: object, generation: number): void;
export declare function configuredMountCredentialFields(entry: Mount | TypedMount): string[];
export declare function manifestHasInContainerMounts(manifest: Manifest): boolean;
export declare function manifestHasNonResumableMountAuthority(manifest: Manifest): boolean;
export declare function persistedManifestRecordHasNonResumableMountAuthority(value: Record<string, unknown>): boolean;
export declare function validateMountCredentialBoundaries(manifest: Manifest): void;
export declare function validateMountEnvironmentCredentialBoundaries(manifest: Manifest, environment: Record<string, string>, options?: {
    preserveDeferredValuePresence?: boolean;
}): void;
export declare function resolveAndValidateMountEnvironment(manifest: Manifest): Promise<Manifest>;
export declare function validateMountCredentialBoundariesAtEffectivePath(manifest: Manifest, logicalPath: string, entry: Mount | TypedMount, effectivePath: string): MountCredentialExposureDecision;
export declare function copyValidatedMountEffectivePaths(target: Manifest, ...sources: Manifest[]): void;
export declare function sanitizeMountCredentialEnvironmentForPersistence(state: {
    manifest: Manifest;
    environment?: Record<string, string>;
}): {
    manifest: Manifest;
    environment: Record<string, string>;
};
export declare function serializeMountCredentialRedactionMetadata(state: {
    manifest: Manifest;
    [key: string]: unknown;
}): Record<string, unknown>;
export declare function deserializeMountCredentialRedactionMetadata(state: Record<string, unknown>): Record<string, unknown>;
export declare function sanitizePersistedManifestRecord(value: Record<string, unknown>): {
    record: Record<string, unknown>;
    credentialPaths: string[];
};
export declare function recordPendingMountCredentialPaths(manifest: Manifest, paths: readonly string[]): void;
export declare function validateMountCredentialRedactionPaths(manifest: Manifest, paths: readonly string[]): void;
export declare function recordPersistedMountTopology(manifest: Manifest): void;
export declare function rebindPersistedMountCredentials<TState extends {
    manifest: Manifest;
    [key: string]: unknown;
}>(state: TState, trustedManifest: Manifest | undefined): TState;
export declare function recordLiveMountCredentialAuthority(target: Manifest, source: Manifest): void;
export declare function captureLiveMountRuntimeAuthority(manifest: Manifest, key: symbol, signature: string): void;
export declare function liveMountRuntimeAuthorityMatches(manifest: Manifest, key: symbol, signature: string): boolean;
export declare function captureLiveMountCredentialAuthority(manifest: Manifest, environment?: Record<string, string>): void;
export declare function captureLiveMountEnvironmentAuthority(manifest: Manifest, environment: Record<string, string>): void;
export declare function captureLiveMountCredentialAuthorityIfAbsent(manifest: Manifest, environment?: Record<string, string>): void;
export declare function copyTrustedMountCredentialRebindProvenance(target: Manifest, source: Manifest): void;
export declare function liveMountCredentialAuthorityMatches(liveManifest: Manifest, trustedManifest: Manifest): boolean;
export declare function assertLiveMountCredentialAuthorityMatches(liveManifest: Manifest, candidateManifest: Manifest): void;
export declare function liveMountEnvironmentAuthorityMatches(liveManifest: Manifest, trustedManifest: Manifest, trustedEnvironment: Record<string, string>): boolean;
export declare function assertLiveMountEnvironmentAuthorityMatches(liveManifest: Manifest, trustedManifest: Manifest, trustedEnvironment: Record<string, string>): void;
export declare function assertExistingMountTopologyPreserved(currentManifest: Manifest, nextManifest: Manifest): void;
export declare function assertMountCredentialsRebound(state: {
    manifest: Manifest;
    [key: string]: unknown;
}): void;
export declare function redactMountCredentialsForPersistence(entry: Mount | TypedMount): Entry;
export declare function mountCredentialFileReferences(manifest: Manifest, entry: Mount | TypedMount, environment?: Record<string, string>): MountCredentialFileReference[];
export declare function validateMountCredentialFileEffectivePaths(args: {
    entry: Mount | TypedMount;
    mountPath: string;
    credentialFiles: readonly MountCredentialFileReference[];
    manifestEntries: readonly EffectiveManifestEntryPath[];
}): void;
export declare function mountCredentialEnvironmentForEntry(entry: Entry, environment: Record<string, string>): Record<string, string>;