/**
 * Plugin Sandbox Worker
 *
 * Executes plugins in isolated worker threads with restricted capabilities.
 * This provides security isolation between plugins and the main application.
 *
 * Features:
 * - Memory isolation via Worker threads
 * - Restricted API surface
 * - Timeout protection
 * - Resource limits
 */
export interface SandboxOptions {
    timeout: number;
    memoryLimit: number;
    permissions: SandboxPermission[];
    pluginPath: string;
    pluginId: string;
}
export interface SandboxPermission {
    type: 'filesystem' | 'network' | 'env' | 'timer';
    scope?: string;
}
export interface SandboxMessage {
    type: 'init' | 'call' | 'result' | 'error' | 'log';
    id?: string;
    method?: string;
    args?: unknown[];
    result?: unknown;
    error?: string;
    level?: string;
    message?: string;
}
export interface SandboxAPI {
    call: (method: string, args: unknown[]) => Promise<unknown>;
    terminate: () => Promise<void>;
}
export declare class PluginSandbox {
    private worker;
    private pendingCalls;
    private messageId;
    private options;
    private onLog?;
    constructor(options: SandboxOptions, onLog?: (level: string, message: string) => void);
    /**
     * Initialize the sandbox and load the plugin
     */
    initialize(pluginAPI: unknown): Promise<void>;
    /**
     * Call a method on the sandboxed plugin
     */
    call(method: string, args?: unknown[]): Promise<unknown>;
    /**
     * Send message to worker and wait for response
     */
    private sendMessage;
    /**
     * Terminate the sandbox
     */
    terminate(): Promise<void>;
    /**
     * Check if sandbox is running
     */
    isRunning(): boolean;
}
/**
 * Create a sandboxed plugin instance
 */
export declare function createPluginSandbox(pluginPath: string, pluginId: string, permissions: SandboxPermission[], pluginAPI: unknown, options?: {
    timeout?: number;
    memoryLimit?: number;
    onLog?: (level: string, message: string) => void;
}): Promise<PluginSandbox>;
