/**
 * Capability-Class Rule Vocabulary (W1.5 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12)
 *
 * Translates plain-English company rules ("no MCP", "no external DB outside BAA",
 * "no shell exec") into pack categories that flow through the existing PackEvaluator
 * hot path. A company pack declares categoryActions for any of the canonical
 * capability-class IDs below, and the matching detector fires when an agent's
 * tool call falls into that class.
 *
 * Action mapping (already in pack-evaluator.ts:actionToVerdict):
 *   BLOCK -> DENY
 *   REQUIRE_APPROVAL / WARN -> PENDING (queues an ApprovalRecord)
 *   LOG / ALLOW -> ALLOW
 *
 * @connexum/ai-governance  F-NEW-PRODUCT-CAPABILITY-CLASS-RULES
 */
/** Canonical capability class IDs. Company packs reference these as category keys. */
export declare const CAPABILITY_CLASS: {
    readonly MCP: "capability:mcp";
    readonly WEB_FETCH: "capability:web-fetch";
    readonly EXTERNAL_DB_WRITE: "capability:external-db-write";
    readonly SHELL_EXEC: "capability:shell-exec";
    readonly FILESYSTEM_WRITE: "capability:filesystem-write";
    readonly NETWORK_EGRESS: "capability:network-egress";
    readonly SECRET_ACCESS: "capability:secret-access";
};
export type CapabilityClassId = (typeof CAPABILITY_CLASS)[keyof typeof CAPABILITY_CLASS];
export declare const ALL_CAPABILITY_CLASS_IDS: readonly CapabilityClassId[];
/**
 * Detector signature matching CategoryClassifierDef.classifier.
 * The pack-evaluator passes a JSON-serialized form of the action context.
 */
export type CapabilityDetector = (serializedInput: string) => boolean;
export declare const detectsMcp: CapabilityDetector;
export declare const detectsWebFetch: CapabilityDetector;
export declare const detectsShellExec: CapabilityDetector;
export declare const detectsFilesystemWrite: CapabilityDetector;
export declare const detectsNetworkEgress: CapabilityDetector;
export declare const detectsSecretAccess: CapabilityDetector;
export declare const detectsExternalDbWrite: CapabilityDetector;
export declare const CAPABILITY_DETECTORS: Record<CapabilityClassId, CapabilityDetector>;
//# sourceMappingURL=capability-classes.d.ts.map