/**
 * CapabilityBundle -- Frozen, sandboxed capability set for AI agents.
 *
 * Creates an Object.freeze'd bundle of allowed operations per agent.
 * Agents cannot monkey-patch or extend their own permissions at runtime.
 *
 * @connexum/ai-governance
 */
export interface CapabilityBundleConfig {
    agentName: string;
    agentDir: string;
    sharedDir: string;
    /** Files that can never be modified */
    immutableFiles?: string[];
    /** Files that can only be appended to */
    appendOnlyFiles?: string[];
    /** Commands allowed in runCommand */
    bashAllowlist?: string[];
    /** Max command timeout in ms */
    commandTimeoutMs?: number;
}
export interface FileResult {
    ok?: boolean;
    content?: string;
    path?: string;
    files?: string[];
    error?: string;
}
export interface CommandResult {
    stdout?: string;
    stderr?: string;
    error?: string;
}
export interface MemoryIntegrityResult {
    tampered: boolean;
    restored: boolean;
    detail: string;
}
/**
 * Creates a frozen capability bundle for an agent.
 * The returned object cannot be modified at runtime.
 */
export declare function createCapabilityBundle(config: CapabilityBundleConfig): Readonly<{
    agentName: string;
    agentDir: string;
    sharedDir: string;
    readFile(relativePath: string): FileResult;
    writeFile(relativePath: string, content: string): FileResult;
    appendFile(relativePath: string, content: string): FileResult;
    listFiles(relativePath?: string): FileResult;
    verifyMemory(): MemoryIntegrityResult;
    runCommand(command: string, args?: string[], opts?: {
        timeout?: number;
        cwd?: string;
    }): Promise<CommandResult>;
    handoff(toAgent: string, task: string, context?: string, priority?: string): FileResult;
}>;
//# sourceMappingURL=capability-bundle.d.ts.map