import type { LoadedEvoComponentArtifact } from "./artifact.ts";
import { type EvoCapabilityRequestFrame } from "./capabilities/protocol.ts";
import type { EvoCapabilityComponentIdentity } from "./capabilities/service.ts";
import type { EvoAbiDefinition } from "./registry.ts";
export type EvoComponentSandboxKind = "bwrap" | "docker";
export interface EvoComponentCapabilityBroker {
    request(component: EvoCapabilityComponentIdentity, frame: EvoCapabilityRequestFrame, signal: AbortSignal): Promise<unknown>;
}
export interface EvoComponentProcessOptions {
    requestTimeoutMs?: number;
    /** Maximum bytes in one component JSONL frame. Primarily overridden by focused tests. */
    maxStdoutFrameBytes?: number;
    /** Maximum aggregate stdout bytes emitted over the component process lifetime. */
    maxStdoutBytes?: number;
    /** Maximum bytes in one host-to-component capability-result JSONL frame. */
    maxCapabilityResultBytes?: number;
    /** Grace between TERM and KILL when tearing down an uncooperative component. */
    terminationGraceMs?: number;
    /** Test/development escape hatch. Production callers should keep this true. */
    sandbox?: boolean;
    capabilityBroker?: EvoComponentCapabilityBroker;
}
/**
 * Resolve the strongest available component sandbox: bwrap when unprivileged user
 * namespaces work, otherwise an equally isolated Docker container (hosts that
 * restrict userns via AppArmor typically still run Docker). The probe result is
 * cached per process.
 */
export declare function resolveEvoComponentSandbox(): Promise<EvoComponentSandboxKind | undefined>;
export declare function canUseEvoComponentSandbox(): Promise<boolean>;
interface ComponentLaunch {
    command: string;
    args: string[];
    env: NodeJS.ProcessEnv;
    dockerContainerName?: string;
}
/** Isolation equivalent to the bwrap profile: no network, read-only rootfs, no capabilities. */
export declare function dockerSandboxCommand(artifact: LoadedEvoComponentArtifact): ComponentLaunch;
export declare class EvoComponentProcess<TInput = unknown, TOutput = unknown, TConfig = unknown> {
    private child?;
    private nextId;
    private readonly pending;
    private readonly inFlightCapabilities;
    private readonly seenCapabilityIds;
    private readonly capabilityAbort;
    private stderr;
    private stdoutFrameBuffer?;
    private stdoutFrameBytes;
    private stdoutBytes;
    private stdoutFailed;
    private childClose?;
    private resolveChildClose;
    private terminationPromise?;
    private terminationError?;
    private dockerContainerName?;
    private stopped;
    private launchedSandbox?;
    private readonly artifact;
    private readonly abi;
    private readonly config;
    private readonly options;
    private readonly maxStdoutFrameBytes;
    private readonly maxStdoutBytes;
    private readonly maxCapabilityResultBytes;
    private readonly terminationGraceMs;
    constructor(artifact: LoadedEvoComponentArtifact, abi: EvoAbiDefinition<TInput, TOutput, TConfig>, config: TConfig, options?: EvoComponentProcessOptions);
    /** The execution boundary this process actually launched under. */
    get sandboxKind(): EvoComponentSandboxKind | "direct" | undefined;
    start(): Promise<void>;
    invoke(input: unknown): Promise<TOutput>;
    health(): Promise<unknown>;
    shutdown(): Promise<void>;
    /** Abort active work and immediately begin TERM-to-KILL process teardown. */
    terminate(reason?: unknown): Promise<void>;
    private request;
    private handleLine;
    private positiveByteLimit;
    private appendStdoutFrameChunk;
    private handleStdoutData;
    private handleCapabilityRequest;
    private finishCapabilityRequest;
    private failProcess;
    private signalChild;
    private waitForChildClose;
    private processGroupExists;
    private waitForProcessGroupExit;
    private dockerContainerState;
    private signalDockerContainer;
    private waitForDockerContainerExit;
    private removeDockerContainer;
    private terminateDockerContainer;
    private beginHardTermination;
    private failAll;
}
export {};
//# sourceMappingURL=process-runtime.d.ts.map