/**
 * Provider script require() whitelist.
 *
 * Provider scripts (detect_status.js, parse_session.js, the override layer
 * the v1 contract exposes, plus their _shared helpers) execute in the
 * daemon process with full Node access — see sandbox/README-design.ts for
 * the long story. Full isolation via isolated-vm has a real perf cost and
 * a real marshalling-complexity cost, so we instead constrain the most
 * dangerous attack surface: what a provider script can `require()`.
 *
 * The hook wraps Node's CJS `Module._load` and, when the calling file is
 * inside a directory that this loader has registered as a provider script
 * root, blocks every module that isn't on the allowlist below. Relative
 * paths are allowed but only when they resolve back inside the same
 * provider root — providers can require their sibling helpers but they
 * can't reach `../../../../etc/passwd` through a clever segment.
 *
 * The hook installs exactly once per process; subsequent `register()` /
 * `unregister()` calls just adjust the set of roots that are gated.
 *
 * Performance: the hook adds one `path.normalize` + one Set lookup to
 * every require call coming from a registered root. At the measured
 * baseline (~6 script invocations / second / session, each making
 * ≤1 require during initial module evaluation, zero during steady-state
 * calls), this is unmeasurable.
 */
/**
 * Wrap `globalThis.process` methods so calls from provider script stacks
 * throw, while every other caller (daemon-core itself, npm deps, the test
 * harness) goes through untouched.
 *
 * Trade-off: this is a stack-introspection check on every call to the
 * affected methods. The methods in question (exit/kill/abort/binding/dlopen)
 * are not hot paths — they're either never called or called once at
 * shutdown. The cost is negligible.
 *
 * Alternative considered: wrap only the module-scope `process` binding via
 * Module._extensions. Node's ESM/CJS semantics make this unreliable across
 * dynamic-require paths. Stack introspection is uglier but correct.
 *
 * Caveat: a provider script that grabs `globalThis.process.exit` once and
 * passes the reference to a non-provider callback can still escape — the
 * stack at the actual call site no longer goes through provider code. We
 * accept this gap; the threat model assumes scripts are not actively
 * trying to launder calls through arbitrary daemon callbacks, just that
 * a naive `process.exit(0)` should not silently terminate the daemon.
 */
export declare function installProviderProcessShim(): void;
/** For tests — restore the original process.* methods. */
export declare function _uninstallProviderProcessShimForTest(): void;
/**
 * Register a directory whose `.js` files should be subject to the
 * whitelist when they call require(). Idempotent — repeated registration
 * of the same root is a no-op. Pass the same string back to
 * `unregisterProviderScriptRoot` to remove it.
 */
export declare function registerProviderScriptRoot(absRoot: string): void;
/** Inverse of registerProviderScriptRoot. */
export declare function unregisterProviderScriptRoot(absRoot: string): void;
/** For tests — drop every registration and reset internal state. */
export declare function _resetProviderScriptRoots(): void;
/** For tests — peek at the gated root list. */
export declare function _getRegisteredRoots(): readonly string[];
/**
 * Public re-exports — registry consumers want to know what's on the
 * allowlist without parsing this file.
 */
export declare const PROVIDER_REQUIRE_POLICY: Readonly<{
    safeStdlib: string[];
    shimmedStdlib: string[];
    fsAllowedMembers: ("existsSync" | "statSync" | "lstatSync" | "realpathSync" | "readFileSync" | "readdirSync" | "readlinkSync" | "accessSync" | "constants" | "exists" | "stat" | "lstat" | "realpath" | "readFile" | "readdir" | "readlink" | "access" | "promises")[];
    childProcessAllowedMembers: string[];
    processDeniedMembers: string[];
}>;
