import { CodedError } from "@mono-agent/agent-contracts";
import type { ProcessIncarnation, SameProcessIncarnation } from "./process-incarnation.js";
export declare const MANAGED_SRT_PACKAGE = "@anthropic-ai/sandbox-runtime";
export declare const MANAGED_SRT_VERSION = "0.0.64";
export declare const MANAGED_SRT_LOCK_SHA256 = "0f34561ddc700ad43c31f254beb0e1e4b87bae61795acac5d7fa890dd5890924";
export declare const MANAGED_SRT_MARKER = ".mono-agent-srt.json";
export type SandboxManagerErrorCode = "managed_srt_unsupported" | "managed_srt_corrupt" | "managed_srt_install_failed" | "managed_srt_lock_unsafe" | "sandbox_check_failed";
export declare class SandboxManagerError extends CodedError<SandboxManagerErrorCode> {
}
export interface ManagedSrtMarker {
    readonly schemaVersion: 2;
    readonly package: typeof MANAGED_SRT_PACKAGE;
    readonly version: typeof MANAGED_SRT_VERSION;
    readonly lockSha256: typeof MANAGED_SRT_LOCK_SHA256;
    readonly cliSha256: string;
    readonly packageJsonSha256: string;
    readonly treeSha256: string;
}
export interface SandboxRuntimeStatus {
    readonly state: "ready" | "absent" | "corrupt" | "unsupported";
    readonly source: "managed" | "external" | "none";
    readonly version: typeof MANAGED_SRT_VERSION;
    readonly installRoot: string;
    readonly nodePath?: string;
    readonly cliPath?: string;
    readonly message: string;
}
export interface SandboxFunctionalCheck {
    readonly id: "engine" | "allowed-filesystem" | "sibling-read-denied" | "env-write-denied" | "outside-write-denied" | "localhost-allowed" | "domain-denied";
    readonly ok: boolean;
    readonly detail: string;
}
export interface SandboxCheckResult {
    readonly status: SandboxRuntimeStatus;
    readonly checks: readonly SandboxFunctionalCheck[];
}
export interface ManagedSrtSetupResult {
    readonly installed: boolean;
    readonly repaired: boolean;
    readonly status: SandboxRuntimeStatus;
    readonly check?: SandboxCheckResult;
}
export interface ManagedSrtHooks {
    readonly installDependencies?: (stagingRoot: string, signal: AbortSignal | undefined) => Promise<void>;
    /**
     * Permanent v0.8-and-earlier file-lock compatibility. v0.9.0 and later write
     * v2 directory locks with process incarnation identity instead.
     */
    readonly processIsAlive?: (pid: number) => "alive" | "dead" | "unknown";
    /** Test/embed seams for persistent v2 install-lock ownership. */
    readonly currentProcessIncarnation?: () => Promise<ProcessIncarnation>;
    readonly isSameProcessIncarnation?: SameProcessIncarnation;
    readonly ownerlessGraceMs?: number;
    readonly now?: () => number;
    readonly installGuardTimeoutMs?: number;
    readonly sleep?: (milliseconds: number, signal: AbortSignal | undefined) => Promise<void>;
    readonly beforeInstallGuardAcquire?: (guardPath: string) => Promise<void>;
    readonly afterInstallGuardAcquired?: (guardPath: string) => Promise<void>;
    readonly beforeInstallGuardClose?: (guardPath: string) => Promise<void>;
    readonly beforeInstallStagingCleanup?: (stagingRoot: string) => Promise<void>;
    /** Narrow deterministic seams for lock publication and pathname-race tests. */
    readonly afterInstallLockDirectoryCreated?: (lockPath: string) => Promise<void>;
    readonly afterInstallLockInspected?: (lockPath: string, kind: "ownerless" | "owned" | "legacy" | "legacy-publishing") => Promise<void>;
    readonly beforeStaleInstallLockRename?: (lockPath: string) => Promise<void>;
    readonly beforeInstallLockReleaseRename?: (lockPath: string) => Promise<void>;
    /** Test-only fixture seam; production always uses the independently pinned tree digest. */
    readonly expectedTreeSha256?: (installRoot: string) => Promise<string>;
}
export interface SandboxManagerOptions {
    readonly cacheRoot?: string;
    readonly resourceRoot?: string;
    readonly platform?: NodeJS.Platform;
    readonly env?: NodeJS.ProcessEnv;
    readonly homeDir?: string;
    readonly nodePath?: string;
    readonly npmCliPath?: string;
    readonly externalCommand?: string | false;
    readonly signal?: AbortSignal;
    readonly installTimeoutMs?: number;
    readonly hooks?: ManagedSrtHooks;
}
export interface ManagedSrtSetupOptions extends SandboxManagerOptions {
    readonly verify?: boolean;
}
export declare function managedSrtInstallRoot(options?: SandboxManagerOptions): string;
export declare function sandboxRuntimeStatus(options?: SandboxManagerOptions): Promise<SandboxRuntimeStatus>;
export declare function setupManagedSrt(options?: ManagedSrtSetupOptions): Promise<ManagedSrtSetupResult>;
export declare function checkSandboxRuntime(options?: SandboxManagerOptions): Promise<SandboxCheckResult>;
//# sourceMappingURL=sandbox-manager.d.ts.map