import type { CommandRule } from "./types.js";
export declare function buildSandboxEnv(processEnv: NodeJS.ProcessEnv, allowlist: readonly string[]): Record<string, string>;
export declare function collectSensitiveEnvValues(processEnv: NodeJS.ProcessEnv, allowlist: readonly string[]): readonly string[];
export interface CommandDecision {
    readonly allowed: boolean;
    readonly reason?: string | undefined;
}
export declare function isCommandAllowed(rules: readonly CommandRule[], executable: string, args: readonly string[]): CommandDecision;
//# sourceMappingURL=sandbox.d.ts.map