/**
 * `vyuh-dxkit allowlist <subcommand>` — orchestrates the user-facing
 * write/read paths over the allowlist module.
 *
 * Subcommands (Sprint 1 chunk):
 *
 *   - `add <file>:<line>` — inline annotation insertion. Kind-agnostic;
 *     the annotation grammar carries category + reason only. Refuses
 *     non-inline-compatible categories (accepted-risk / deferred).
 *
 *   - `add --fingerprint=<id> --kind=<kind>` — file-level allowlist
 *     entry. Persists to `.dxkit/allowlist.json` (or its sanitized
 *     mode + gitignored reasons sidecar). Required for any
 *     accepted-risk / deferred suppression OR any kind that lacks a
 *     stable single-line attachment point.
 *
 *   - `list` — print every entry across the file-level allowlist.
 *     Reads only; no mutation. Honors `--json` for structured output.
 *
 *   - `show <fingerprint>` — print one entry's full detail. Falls
 *     back to a "no entry found" message when the fingerprint isn't
 *     present.
 *
 * Subcommands `audit` and `prune` land in a follow-up commit.
 *
 * # Architectural posture
 *
 * Every IO goes through `loadAllowlist` / `saveAllowlist` in
 * `src/allowlist/file.ts` (arch-rule 1 enforces this). Inline
 * annotation insertion goes through `insertAnnotation` in
 * `src/allowlist/inline.ts`. Per-kind / per-category validation
 * goes through `categories.ts` helpers. NO duplicated taxonomy or
 * IO logic here — this file is pure orchestration.
 */
import { DEFAULT_EXPIRY_DAYS } from './categories';
import { ALLOWLIST_FILENAME, type AllowlistMode } from './file';
/** Subcommands recognized under `vyuh-dxkit allowlist`. */
export declare const ALLOWLIST_SUBCOMMANDS: readonly ["add", "list", "show", "audit", "prune"];
export type AllowlistSubcommand = (typeof ALLOWLIST_SUBCOMMANDS)[number];
export interface AllowlistAddOpts {
    /** Positional target. `<file>:<line>` for inline form; absent or a
     *  bare file path for file-level form (requires `--fingerprint`
     *  + `--kind`). */
    readonly target?: string;
    readonly category?: string;
    readonly reason?: string;
    readonly kind?: string;
    readonly fingerprint?: string;
    readonly expires?: string;
    readonly acknowledgedSeverity?: string;
    readonly addedBy?: string;
    /** Override the configured mode for this write only. Default
     *  reads from `.dxkit/policy.json` (out of scope here; this
     *  module accepts a flag to choose). */
    readonly mode?: AllowlistMode;
}
export interface AllowlistShowOpts {
    readonly fingerprint?: string;
    readonly json?: boolean;
}
export interface AllowlistListOpts {
    readonly json?: boolean;
}
export interface AllowlistAuditOpts {
    readonly json?: boolean;
    /** Soon-to-expire horizon in days (default 14). */
    readonly soonToExpireDays?: number;
}
export interface AllowlistPruneOpts {
    readonly json?: boolean;
    /** Don't write; just print what would be removed. */
    readonly dryRun?: boolean;
    /** Skip confirmation prompt + write directly. Default behavior
     *  in Sprint 1 (no interactive prompts in dxkit yet) — the flag
     *  is accepted for future-proofing. */
    readonly yes?: boolean;
}
/**
 * Dispatch entry point called from `src/cli.ts`. Validates the
 * subcommand name + routes to the per-subcommand handler. Unknown
 * subcommands exit with a clear error and the list of recognized
 * names.
 */
export declare function runAllowlist(cwd: string, subcommand: string | undefined, args: {
    positionalAfter?: string;
    values: Record<string, unknown>;
}): Promise<void>;
export declare function runAllowlistAdd(cwd: string, opts: AllowlistAddOpts): Promise<void>;
export declare function runAllowlistList(cwd: string, opts: AllowlistListOpts): Promise<void>;
export declare function runAllowlistShow(cwd: string, opts: AllowlistShowOpts): Promise<void>;
export declare function runAllowlistAudit(cwd: string, opts: AllowlistAuditOpts): Promise<void>;
export declare function runAllowlistPrune(cwd: string, opts: AllowlistPruneOpts): Promise<void>;
export { DEFAULT_EXPIRY_DAYS };
export { ALLOWLIST_FILENAME };
//# sourceMappingURL=cli.d.ts.map