interface SealablePyodide {
    FS?: unknown;
    _module?: unknown;
    _api?: {
        config?: {
            indexURL?: string;
            packageBaseUrl?: string;
            packageCacheDir?: string;
        };
        loadBinaryFile?: (path: string, ...rest: unknown[]) => unknown;
    };
}
/** Remove host handles, returning any names that could not be removed. */
export declare function stripWorkerGlobals(realm: Record<string, unknown>): string[];
/**
 * Close the exposed Pyodide APIs that captured host filesystem handles at load.
 * This is worker hardening, not an isolation boundary against arbitrary JS.
 *
 * @param pyodide The loaded interpreter.
 */
export declare function sealPyodideHostApis(pyodide: SealablePyodide): Promise<void>;
/**
 * Seal one Node worker after initialization and before guest execution. Older
 * Node releases without synchronous module hooks deliberately remain unsealed.
 *
 * @param pyodide The loaded interpreter.
 * @param realm The worker's global object.
 */
export declare function sealWorkerRealm(pyodide: SealablePyodide, realm?: Record<string, unknown>): Promise<void>;
export {};
//# sourceMappingURL=seal.d.ts.map