/**
 * @license
 * Copyright 2026 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
import { type SandboxManager, type SandboxRequest, type SandboxedCommand, type GlobalSandboxOptions } from '../../services/sandboxManager.js';
/**
 * A SandboxManager implementation for Windows that uses Restricted Tokens,
 * Job Objects, and Low Integrity levels for process isolation.
 * Uses a native C# helper to bypass PowerShell restrictions.
 */
export declare class WindowsSandboxManager implements SandboxManager {
    private readonly options;
    private readonly helperPath;
    private initialized;
    private readonly lowIntegrityCache;
    constructor(options: GlobalSandboxOptions);
    /**
     * Ensures a file or directory exists.
     */
    private touch;
    private ensureInitialized;
    /**
     * Prepares a command for sandboxed execution on Windows.
     */
    prepareCommand(req: SandboxRequest): Promise<SandboxedCommand>;
    /**
     * Grants "Low Mandatory Level" access to a path using icacls.
     */
    private grantLowIntegrityAccess;
}
