/**
 * @license
 * Copyright 2026 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import { type SandboxPermissions } from '../../services/sandboxManager.js';
/**
 * Options for building macOS Seatbelt profile.
 */
export interface SeatbeltArgsOptions {
    /** The primary workspace path to allow access to. */
    workspace: string;
    /** Additional paths to allow access to. */
    allowedPaths: string[];
    /** Absolute paths to explicitly deny read/write access to (overrides allowlists). */
    forbiddenPaths: string[];
    /** Whether to allow network access. */
    networkAccess?: boolean;
    /** Granular additional permissions. */
    additionalPermissions?: SandboxPermissions;
    /** Whether to allow write access to the workspace. */
    workspaceWrite?: boolean;
}
/**
 * Escapes a string for use within a Scheme string literal "..."
 */
export declare function escapeSchemeString(str: string): string;
/**
 * Builds a complete macOS Seatbelt profile string using a strict allowlist.
 * It embeds paths directly into the profile, properly escaped for Scheme.
 */
export declare function buildSeatbeltProfile(options: SeatbeltArgsOptions): string;
