import type { Caller } from '../context/session_context.ts';
import type { SessionAccess } from '../view/types.ts';
import type { Decisions } from './decisions.ts';
import type { EntryGate } from './types.ts';
import type { Policies } from './policies.ts';
import type { MountMode, PathSpec } from '../types.ts';
import type { VfsCall } from '../vfs/types.ts';
/** The POSIX policy boundary for dispatched filesystem operations: the
 * ordered builtin and user policies, the owning mount prefix, its
 * configured mode (the authorization ceiling), the session whose grants
 * govern the op, the approval ledger a path rule that asks is put to
 * where no line is running, and who makes the op (without one, the gates
 * read the async context's). Mirrors Python's Boundary. */
export declare class Boundary {
    readonly policies: Policies;
    readonly prefix: string;
    readonly mode?: MountMode | undefined;
    readonly sessionId: string;
    readonly decisions: Decisions | null;
    readonly access?: SessionAccess | undefined;
    readonly caller?: Caller | undefined;
    constructor(policies: Policies, prefix?: string, mode?: MountMode | undefined, sessionId?: string, decisions?: Decisions | null, access?: SessionAccess | undefined, caller?: Caller | undefined);
    admit(call: VfsCall, path: PathSpec, write: boolean, access?: {
        final?: boolean;
        gate?: EntryGate | null;
    }, issuer?: symbol): Promise<void>;
    /** Fire postVfs on a finished call and hand its result back whole. */
    complete(call: VfsCall, path: PathSpec, write: boolean, result: unknown, issuer?: symbol): Promise<unknown>;
}
//# sourceMappingURL=boundary.d.ts.map