/**
 * DestructiveStage - Gated, AST-based destructive-command detection (E2).
 *
 * Runs AFTER the parse stage (so the AST is available) and BEFORE the
 * interpret stage. It analyzes the PARSED AST — not the flat command string —
 * so structural obfuscations are caught (command substitution, $IFS expansion,
 * fork bombs, decode-pipe-to-shell) while dangerous strings that merely sit in
 * an `echo`/`grep` ARGUMENT are NOT flagged.
 *
 * Policy (default WARN):
 *   - "warn"   : attach a typed Observation + stderr warning line, then STILL
 *                EXECUTE. The warning is stashed on the pipeline context and
 *                merged into the interpreter-produced result by the runner.
 *   - "block"  : short-circuit with a non-zero result WITHOUT interpreting.
 *   - "prompt" : no interactive prompt is possible in-process, so this falls
 *                back to BLOCK behavior with a note in stderr. Documented.
 *   - "allow"  : do nothing (detection disabled at the gate).
 *
 * The default WARN policy is deliberately NON-BREAKING: every command that ran
 * before this stage existed STILL runs — WARN executes.
 */
import type { PipelineContext, PipelineStage, StageResult } from "../types.js";
/**
 * How the gate responds to a detected destructive command.
 * Default is "warn" (attach observation + stderr, still execute).
 */
export type DestructivePolicy = "warn" | "block" | "prompt" | "allow";
export declare class DestructiveStage implements PipelineStage {
    readonly name = "destructive";
    private readonly defaultPolicy;
    /**
     * @param defaultPolicy - Instance-level policy (from BashOptions). Defaults
     *   to "warn". A per-call ExecOptions.destructivePolicy overrides this.
     */
    constructor(defaultPolicy?: DestructivePolicy);
    execute(context: PipelineContext): Promise<StageResult>;
}
