/**
 * Deno Permission Profiles
 *
 * Typed permission flag constants for different execution contexts.
 * Used internally by CLI and build tooling — not part of the public API.
 *
 * @module security/deno-permissions
 */
/**
 * SERVER — CLI server (dev, production, proxy, MCP, split-mode).
 * Also used by build and test tasks that need equivalent access.
 */
export declare const SERVER_PERMISSIONS: readonly ["--allow-read", "--allow-write", "--allow-net", "--allow-env", "--allow-run", "--allow-sys", "--unstable-worker-options", "--unstable-net"];
/**
 * WORKFLOW_RUN — `ProcessRunExecutor` (RESTRICTED).
 * Runs user-authored code — no `--allow-run`, `--allow-ffi`, or `--allow-sys`.
 *
 * `--allow-env` is intentionally left unscoped here rather than pinned to a
 * static allowlist: the set of env vars a run legitimately needs (tenant
 * context, MODE/run IDs, and operator-supplied extension variables) is assembled
 * dynamically per execution and cannot be enumerated statically. The child uses
 * `clearEnv: true`, so it does not ordinarily inherit arbitrary host variables.
 * This profile still grants broad read, write, and network access and is only
 * suitable for trusted local code. It is not a secret-isolation boundary.
 */
export declare const WORKFLOW_RUN_PERMISSIONS: readonly ["--allow-read", "--allow-write", "--allow-net", "--allow-env"];
/**
 * BUILD_HELPER — manifest generators, framework source prep.
 * Only needs filesystem + env access.
 */
export declare const BUILD_HELPER_PERMISSIONS: readonly ["--allow-read", "--allow-write", "--allow-env"];
/**
 * RENDER_WORKER — Per-project Worker for isolated code execution.
 * Read-only filesystem (transformed modules), network (data fetchers),
 * env (API keys and config). No subprocess/ffi/sys.
 */
export declare const RENDER_WORKER_PERMISSIONS: readonly ["--allow-read", "--allow-net", "--allow-env"];
//# sourceMappingURL=deno-permissions.d.ts.map