import type { Refusal } from '../types.ts';
/**
 * A policy returned something a method may not return. Raised loudly at
 * the seam (never silently dropped): an illegal Action kind for the
 * method, or a value that is not an Action at all, is a programming
 * error in the policy, not a refusal.
 */
export declare class PolicyError extends Error {
    constructor(message: string);
}
/**
 * A dry run reached the op gate: the dispatcher stops there, before any backend
 * or cache is touched, with what the gate would answer noted for
 * `session.explain.vfs`. Mirrors the Python `Explained`.
 */
export declare class Explained extends Error {
    constructor();
}
/**
 * An op or a session write refused by an admission policy at an entry point.
 * Shaped like the FsError stamps (`code` EACCES plus the virtual path)
 * so every fs chokepoint renders GNU's "Permission denied" and the FUSE
 * bridge classifies it to -EACCES; the distinct class lets handlers that
 * special-case mount-mode refusals (the read-only wording) tell a
 * policy deny apart.
 *
 * The message says what the terminal would (`Permission denied` at the
 * dispatcher, `<name>: permission denied` at the session view), and the
 * policy's own words ride `refusal`, never the message, so an entry point that
 * renders the error stays byte-identical to a plain EACCES and an entry point
 * that hands the agent text appends the record's line. `refusal` is
 * null for an entry point that refuses on no policy's behalf (a hidden
 * variable).
 *
 * It carries no accounting: a postVfs refusal suppresses the result,
 * not the effect, and the dispatcher reports the completed op through the
 * caller's `OpReport`, which covers this error and any foreign one the
 * same way.
 */
export declare class PolicyDenied extends Error {
    readonly code = "EACCES";
    readonly virtualPath: string;
    readonly refusal: Refusal | null;
    constructor(message: string, virtualPath: string, refusal?: Refusal | null);
}
//# sourceMappingURL=errors.d.ts.map