export declare const RLM_MANAGED_PYTHON_PACKAGES: readonly string[];
export interface PythonRuntimeOptions {
    /** Create/use <cwd>/.gjc/python-env when no BYO venv/conda env is present. */
    managedWorkspaceVenv?: boolean;
    /** Packages to seed into the managed workspace venv when provisioning it. */
    seedPackages?: readonly string[];
}
export interface PythonRuntimeLifecycleOptions {
    signal?: AbortSignal;
    deadlineMs?: number;
}
export interface PythonRuntime {
    /** Path to python executable */
    pythonPath: string;
    /** Filtered environment variables */
    env: Record<string, string | undefined>;
    /** Path to virtual environment, if detected */
    venvPath?: string;
}
/**
 * Filter environment variables to a safe allowlist for Python subprocesses.
 * Removes sensitive API keys and limits to known-safe variables.
 */
export declare function filterEnv(env: Record<string, string | undefined>): Record<string, string | undefined>;
/**
 * Detect virtual environment path from VIRTUAL_ENV or common locations.
 */
export declare function resolveVenvPath(cwd: string): string | undefined;
/**
 * Resolve Python runtime including executable path, environment, and venv detection.
 */
export declare function resolvePythonRuntime(cwd: string, baseEnv: Record<string, string | undefined>, options?: PythonRuntimeOptions): PythonRuntime;
export declare function ensurePythonRuntime(cwd: string, baseEnv: Record<string, string | undefined>, options?: PythonRuntimeOptions, lifecycle?: PythonRuntimeLifecycleOptions): Promise<PythonRuntime>;