/** The filesystem access a child process is expected to have. */
export type ExecutionFilesystemScope = "none" | "cwd" | "declared";
/** Network access requested by an execution policy. */
export type ExecutionNetworkAccess = "deny" | "allow";
/**
 * A public, token-only execution policy. It describes a required capability; it is not an
 * isolation mechanism by itself.
 */
export interface ExecutionPolicy {
    readonly filesystem: ExecutionFilesystemScope;
    readonly network: ExecutionNetworkAccess;
    readonly timeMs: number;
    readonly capabilityCeiling: readonly string[];
}
/** An adapter that can prove whether it satisfies a contract's execution policy. */
export interface ExecutionPolicyAdapter {
    readonly name: string;
    canSatisfy(policy: ExecutionPolicy): boolean | PromiseLike<boolean>;
    /** Token-only limitations are suitable for evidence and diagnostics. */
    limitations(policy: ExecutionPolicy): readonly string[];
}
export declare function defineExecutionPolicy(policy: ExecutionPolicy): ExecutionPolicy;
//# sourceMappingURL=execution-policy.d.ts.map