/**
 * The managed `sandbox/` declaration primitive.
 *
 * A Managed Deep Agent declares its execution environment in `sandbox/index.ts`
 * with `defineSandbox`. MDA owns how the sandbox is *resolved*: construction,
 * per-thread reuse, deploy-time snapshot bake from `setup.sh`, and lifecycle/TTL.
 *
 * @example
 * ```ts
 * // sandbox/index.ts
 * import { defineSandbox } from "managed-deepagents";
 *
 * export const sandbox = defineSandbox({ defaultTimeout: 600 });
 * ```
 */
import type { LangSmithSandbox } from "deepagents";
/**
 * Provider options MDA owns and developers must not set directly.
 *
 * MDA owns sandbox identity and managed runtime safety knobs. Use
 * `snapshotName`, `snapshotId`, or `dockerImage` when an explicit LangSmith
 * bake base is needed.
 */
type ManagedSandboxOptionKey = "name" | "image" | "snapshot" | "imageName" | "templateName" | "scope";
type LangSmithCreateOptions = typeof LangSmithSandbox extends {
    create(options: infer TOptions): Promise<unknown>;
} ? TOptions extends object ? TOptions : never : never;
/**
 * Developer-provided options for the managed sandbox.
 *
 * Mirrors the supported LangSmith creation options, minus the fields MDA owns,
 * plus bake-base and lifecycle knobs. Reuse is always one sandbox per thread.
 */
export type SandboxOptions = SandboxSharedOptions & SandboxBakeBase;
/**
 * Lifecycle and LangSmith create knobs that are always allowed, regardless of
 * which bake base (if any) the author picks.
 */
type SandboxSharedOptions = Omit<LangSmithCreateOptions, ManagedSandboxOptionKey> & {
    /**
     * @deprecated Sandbox reuse is always scoped to the thread. Remove this
     * option from the sandbox declaration. Support for this option will be
     * removed in v0.7.0.
     */
    scope?: "thread";
    /**
     * Idle TTL in seconds. MDA may reclaim the sandbox after this period of
     * inactivity.
     */
    idleTtlSeconds?: number;
};
/** Credentials for a private Docker registry, reconciled by MDA at bake time. */
export interface SandboxRegistry {
    /** Registry host, for example `ghcr.io`. */
    url: string;
    /** Registry username (for GHCR, the GitHub account or organization user). */
    username: string;
    /**
     * Name of an environment variable containing the registry password/token.
     *
     * MDA reads the value from the project `.env` or process environment. Only
     * this variable name is compiled; the credential value never enters the
     * build or recipe snapshot.
     */
    passwordEnv: string;
}
/**
 * Deploy-time bake base. At most one of `snapshotName`, `snapshotId`, or
 * `dockerImage` may be set — combining them is a type error.
 *
 * `registry` is only valid with `dockerImage`. MDA creates or updates a
 * deployment-owned Host registry before pulling the private image.
 */
export type SandboxBakeBase = {
    snapshotName?: undefined;
    snapshotId?: undefined;
    dockerImage?: undefined;
    registry?: undefined;
} | {
    /** LangSmith snapshot name used as the bake base (supports tags). */
    snapshotName: string;
    snapshotId?: never;
    dockerImage?: never;
    registry?: never;
} | {
    /** LangSmith snapshot id used as the bake base. */
    snapshotId: string;
    snapshotName?: never;
    dockerImage?: never;
    registry?: never;
} | {
    /** Docker image used as the bake base. */
    dockerImage: string;
    snapshotName?: never;
    snapshotId?: never;
    /**
     * Private registry credentials resolved and reconciled by MDA at bake.
     */
    registry?: SandboxRegistry;
};
/** The object exported from `sandbox/index.ts`. */
export interface SandboxDefinition {
    readonly kind: "sandbox";
    readonly options: SandboxOptions;
}
/**
 * Reject provider options MDA owns and enforce bake-base mutual exclusion.
 *
 * Used by `defineSandbox`, so runtime-owned keys never enter a definition.
 */
export declare function normalizeSandboxOptions(options?: SandboxOptions): SandboxOptions;
/** Declare the managed execution environment for an agent. */
export declare function defineSandbox(options?: SandboxOptions): SandboxDefinition;
export {};
//# sourceMappingURL=sandbox.d.ts.map