/**
 * Code-Mode Executor - TypeScript code execution with tool access
 * Based on official UTCP Code-Mode implementation pattern
 *
 * Execution hierarchy (most secure first):
 * 1. IsolatedVMSandbox - True V8 Isolate (same tech as Cloudflare Workers)
 * 2. SubprocessSandbox - True process isolation via child_process.spawn
 * 3. Worker Threads - V8 isolate with resource limits
 * 4. VM Module - Same-process sandbox (fallback)
 *
 * Phase 3: Bindings for credential isolation
 * Phase 4: Network isolation
 */
import { BindingsManager } from './bindings-manager.js';
import { NetworkPolicyManager } from './network-policy.js';
export interface ToolDefinition {
    name: string;
    description: string;
    inputSchema: any;
}
export interface PhotonInstance {
    name: string;
    instance: any;
    methods: string[];
}
export interface CodeExecutionResult {
    result: any;
    logs: string[];
    error?: string;
    runId?: string;
    errorDetails?: {
        originalError: any;
        pendingCalls?: {
            toolCalls: number;
            bindingCalls: number;
            networkCalls: number;
        };
    };
}
export declare class CodeExecutor {
    private toolExecutor;
    private toolsProvider;
    private photonInstancesProvider?;
    private bindingsManager;
    private networkPolicyManager;
    private codeAnalyzer;
    private semanticValidator;
    private workspacePath;
    constructor(toolsProvider: () => Promise<ToolDefinition[]>, toolExecutor: (toolName: string, params: any) => Promise<any>, photonInstancesProvider?: () => Promise<PhotonInstance[]>, bindingsManager?: BindingsManager, networkPolicyManager?: NetworkPolicyManager, ncpDir?: string);
    /**
     * Ensure workspace directory exists
     */
    ensureWorkspace(): Promise<void>;
    /**
     * Get the workspace path for file operations
     */
    getWorkspacePath(): string;
    /**
     * Update network policy manager (for runtime elicitation setup)
     * Called from orchestrator after construction to wire up elicitation function
     */
    setNetworkPolicyManager(networkPolicyManager: NetworkPolicyManager): void;
    /**
     * Check if code requires non-whitelisted packages and handle approval
     * Uses MCP elicitation if available, falls back to native OS dialog
     * Returns the list of temporarily approved packages for this execution
     */
    private checkPackageApproval;
    /**
     * Execute TypeScript code with tool access
     *
     * Execution hierarchy (most secure first):
     * 1. IsolatedVMSandbox - True V8 Isolate (same tech as Cloudflare Workers)
     * 2. SubprocessSandbox - True process isolation via child_process.spawn
     * 3. Worker Threads - V8 isolate with resource limits
     * 4. VM Module - Same-process sandbox (fallback)
     *
     * Phase 5: Audit logging for security monitoring
     * Phase 6: Runtime package approval with elicitation
     */
    executeCode(code: string, timeout?: number): Promise<CodeExecutionResult>;
    /**
     * Execute code in IsolatedVMSandbox (most secure)
     *
     * Uses isolated-vm for true V8 Isolate separation:
     * - Completely separate V8 isolate (no shared memory at all)
     * - Same technology as Cloudflare Workers
     * - Memory limits enforced at V8 level
     * - No access to Node.js APIs by design
     * - Cannot access file system, network, or process
     *
     * Note: Bindings and network calls are currently not supported in
     * isolated-vm mode - they require the Worker Thread fallback.
     */
    private executeWithIsolatedVM;
    /**
     * Execute code in SubprocessSandbox (second most secure)
     *
     * Uses child_process.spawn for true process isolation:
     * - Separate V8 isolate (no shared memory)
     * - Can be killed without affecting main process
     * - Resource limits enforced by OS
     * - No prototype pollution can escape to main process
     *
     * Note: Bindings and network calls are currently not supported in subprocess
     * mode - they require the Worker Thread fallback.
     */
    private executeWithSubprocess;
    /**
     * Execute code in Worker Thread with resource limits
     * Phase 2: True process isolation
     * Phase 3: Bindings for credential isolation
     * Phase 5: AST-based validation pipeline
     * Phase 6: Dynamic package whitelist from approval manager
     */
    private executeWithWorkerThread;
    /**
     * Execute code in VM context (fallback)
     * Phase 1: Basic security with frozen prototypes
     * Phase 5: AST-based validation pipeline
     */
    private executeWithVM;
    /**
     * Harden JavaScript context to prevent prototype pollution and sandbox escape
     * Phase 1: Quick Security Wins
     */
    private hardenContext;
    /**
     * Validate code using AST-based analysis and semantic validation
     * Phase 1: Static Analysis with TypeScript AST
     * Phase 2: Semantic validation for intent classification
     */
    private validateCodeWithPipeline;
    /**
     * Create VM execution context with tools organized by namespace
     * Based on official UTCP pattern
     */
    private createExecutionContext;
    /**
     * Execute code with timeout
     */
    private runWithTimeout;
    /**
     * Generate TypeScript interface definitions for all tools
     */
    private generateTypeScriptInterfaces;
    /**
     * Convert tool to TypeScript function signature
     */
    private toolToTypeScriptInterface;
    /**
     * Sanitize identifier for valid TypeScript
     */
    private sanitizeIdentifier;
}
//# sourceMappingURL=code-executor.d.ts.map