export type RuntimeSandboxMode = "read-only" | "workspace-write";
export type RuntimeSandboxEnforcement = "env-only" | "provider-native" | "not-enforced";
export type RuntimeNetworkPolicy = "unspecified" | "allowed" | "blocked-planned";
export type RuntimeSecretEnvPolicy = "drop-by-default" | "explicit-grants";
export interface RuntimeSandboxProfile {
    readonly mode: RuntimeSandboxMode;
    readonly enforcement: RuntimeSandboxEnforcement;
    readonly cwd: string;
    readonly writableRoots: readonly string[];
    readonly readableRoots: readonly string[];
    readonly network: RuntimeNetworkPolicy;
    readonly secretEnvPolicy: RuntimeSecretEnvPolicy;
    readonly notes?: readonly string[];
}
export interface CreateRuntimeSandboxProfileOptions {
    readonly cwd: string;
    readonly mode?: RuntimeSandboxMode;
    readonly enforcement?: RuntimeSandboxEnforcement;
    readonly writableRoots?: readonly string[];
    readonly readableRoots?: readonly string[];
    readonly network?: RuntimeNetworkPolicy;
    readonly secretEnvPolicy?: RuntimeSecretEnvPolicy;
    readonly notes?: readonly string[];
}
export declare function createRuntimeSandboxProfile(options: CreateRuntimeSandboxProfileOptions): RuntimeSandboxProfile;
