/** Facade the BRIDGE provides: executes one governed op. The bridge
 *  performs authz + tracing; the worker only ever sees op names. */
export type GovernedFacade = (op: string, args: Record<string, unknown>) => Promise<unknown>;
export interface CodeWorkerLimits {
    wallClockMs: number;
    maxOps: number;
    maxArgBytes: number;
    maxConsoleLines: number;
    maxOutputBytes: number;
    maxScreenshots: number;
    maxNavigations: number;
    /** Heap cap (MB) passed as --max-old-space-size. Also controls the
     *  OS-level rlimit on Linux (bwrap --rlimit) and macOS (ulimit -v).
     *  Default 256 MB; hard cap 512 MB to prevent OOM on the host. */
    maxMemoryMb: number;
    /** CPU time limit in seconds for the macOS ulimit -t wrapper.
     *  Ignored on other platforms (wall-clock timer is the backstop).
     *  Default 60 (matches wallClockMs default). */
    maxCpuSeconds: number;
}
export declare const DEFAULT_LIMITS: CodeWorkerLimits;
export interface SubActionTrace {
    seq: number;
    op: string;
    ok: boolean;
    ms: number;
    error?: string;
}
export interface CodeRunResult {
    ok: boolean;
    result?: unknown;
    console: string[];
    traces: SubActionTrace[];
    error?: {
        code: string;
        message: string;
    };
    /** Which OS sandbox actually wrapped the child. */
    sandbox: "bubblewrap" | "seatbelt" | "node-permission-only" | "none";
    killVerified: boolean;
}
export declare function runSandboxedScript(opts: {
    script: string;
    scratchDir: string;
    facade: GovernedFacade;
    limits?: Partial<CodeWorkerLimits>;
    onTrace?: (t: SubActionTrace) => void;
    log?: (m: string) => void;
}): Promise<CodeRunResult>;