/**
 * Deno Worker permission object.
 * See: https://docs.deno.com/runtime/fundamentals/permissions/
 */
export interface WorkerPermissions {
    read: readonly string[] | boolean;
    write: boolean;
    net: boolean;
    env: readonly string[] | boolean;
    run: boolean;
    ffi: boolean;
    sys: boolean;
    /** Remote module loading is always denied; extension worker graphs must be local. */
    import: readonly string[] | boolean;
}
interface WorkerPermissionOptions {
    /** Override for tests that need to exercise compiled-binary behavior. */
    isCompiledBinary?: boolean;
    /** Override for tests that need deterministic compiled-binary support paths. */
    compiledReadPaths?: string[];
}
/**
 * Build scoped permissions for a project worker.
 *
 * - read: restricted to exact project roots and immutable framework source dirs
 * - write: denied (workers produce output via postMessage, not filesystem)
 * - net: broker-scoped by ProjectWorker before user code starts
 * - env: denied; request-owned project env travels through handler contexts
 * - run: denied (no subprocess spawning from user code)
 * - ffi: denied (no native code from user code)
 * - sys: denied (no system info access from user code)
 */
export declare function buildWorkerPermissions(readPaths: string[], options?: WorkerPermissionOptions): WorkerPermissions;
export {};
//# sourceMappingURL=worker-permissions.d.ts.map