/**
 * Execution Gate Module — Credential Pre-flight
 *
 * ARCHITECTURE:
 *   The CLI does NOT resolve entitlements, maintain email allowlists,
 *   or enforce access policy locally. Authorization is a platform concern.
 *
 *   This gate checks whether ANY credential source exists before sending
 *   a request that would be guaranteed to 401. It checks:
 *     1. Environment variables (AGENTICS_API_KEY, AGENTICS_AUTH_TOKEN, etc.)
 *     2. Stored credentials from `agentics login`
 *
 *   If any credential exists, the request proceeds and the platform
 *   enforces actual policy.
 */
export type Entitlement = 'internal' | 'paid' | 'none';
export declare const EXECUTION_BLOCKED_EXIT_CODE: 77;
export interface ExecutionGateResult {
    allowed: boolean;
    exitCode?: number;
    message?: string;
}
/**
 * Check if a command is allowed to execute.
 *
 * For identity/help commands: always allowed (transport-level).
 * For all other commands: checks whether any credential source exists.
 * The platform decides actual authorization when the request arrives.
 */
export declare function checkExecutionGate(command: string): Promise<ExecutionGateResult>;
/**
 * Enforce the execution gate. Exits the process if blocked.
 */
export declare function enforceExecutionGate(command: string): Promise<void>;
/**
 * @deprecated Entitlement resolution is now platform-side.
 * This stub checks for credential presence only — not entitlement type.
 */
export declare function resolveEntitlement(): Entitlement;
/**
 * @deprecated Use checkExecutionGate() instead.
 */
export declare function isExecutionEnabled(): Promise<boolean>;
/**
 * Get the list of commands that bypass the execution gate.
 */
export declare function getAllowedCommands(): ReadonlySet<string>;
//# sourceMappingURL=execution-gate.d.ts.map