/**
 * Sandbox Service
 *
 * Manages isolated execution environments for agent operations.
 * Enforces trust-tier-based capabilities through network and filesystem policies.
 *
 * @packageDocumentation
 */
import { type SandboxInstance, type SandboxExecutionResult, type ExecutionContext, SandboxRuntime } from './types.js';
export declare class SandboxService {
    private instances;
    private runtimeAdapter;
    constructor(runtime?: SandboxRuntime);
    /**
     * Create a new sandbox for agent execution
     */
    createSandbox(carId: string, trustTier: number, context: ExecutionContext): Promise<SandboxInstance>;
    /**
     * Execute a command in a sandbox
     */
    execute(sandboxId: string, command: string, args?: string[], stdin?: string): Promise<SandboxExecutionResult>;
    /**
     * Destroy a sandbox and clean up resources
     */
    destroy(sandboxId: string): Promise<void>;
    /**
     * Get sandbox instance by ID
     */
    getInstance(sandboxId: string): SandboxInstance | undefined;
    /**
     * List all active sandboxes
     */
    listInstances(): SandboxInstance[];
    /**
     * Get capabilities for a trust tier
     */
    private getCapabilities;
    /**
     * Select runtime based on trust tier
     */
    private selectRuntime;
    /**
     * Build network policy from capabilities
     */
    private buildNetworkPolicy;
    /**
     * Build filesystem policy from capabilities
     */
    private buildFilesystemPolicy;
    /**
     * Build resource limits from capabilities
     */
    private buildResourceLimits;
    /**
     * Detect policy violations from activity logs
     */
    private detectViolations;
    /**
     * Build attestation data from execution results
     */
    private buildAttestationData;
    private createRuntimeAdapter;
    private getRateLimit;
    private getEgressLimit;
    private getConnectionLimit;
    private getDiskQuota;
}
export declare function createSandboxService(runtime?: SandboxRuntime): SandboxService;
export declare function getSandboxService(): SandboxService;
//# sourceMappingURL=sandbox-service.d.ts.map