export type CapabilityPosture = 'available' | 'gated' | 'design-only' | 'blocked';
export type CapabilityControl = 'explicit-grant' | 'time-limit' | 'audit-log' | 'dry-run' | 'sandbox' | 'allowlist' | 'kill-switch' | 'human-confirmation' | 'redaction' | 'rollback';
export interface CapabilityPolicy {
    id: string;
    label: string;
    category: 'computer' | 'browser' | 'credentials' | 'shell' | 'skills' | 'finance' | 'communications' | 'automation' | 'code' | 'agents';
    posture: CapabilityPosture;
    summary: string;
    readiness: string;
    existingCoverage: string[];
    missingConnectors: string[];
    requiredControls: CapabilityControl[];
}
export interface CapabilityEvaluationInput {
    capabilityId: string;
    requestedControls?: CapabilityControl[];
    explicitGrant?: boolean;
    killSwitchActive?: boolean;
}
export interface CapabilityGrant {
    id: string;
    capabilityId: string;
    controls: CapabilityControl[];
    reason: string;
    grantedAt: string;
    expiresAt: string;
    revokedAt?: string;
    /**
     * Optional per-grant command allowlist. When the grant covers a
     * shell-execution capability (e.g. `arbitrary-shell`), each entry is
     * a regex source (anchored implicitly) that operators have deliberately
     * approved alongside the built-in preset list. Patterns invalid as
     * RegExp are silently dropped at evaluation time so a corrupt entry
     * never opens the gate. Empty array (or omitted) means "rely on the
     * built-in preset list only" — the conservative default.
     */
    commandAllowlist?: string[];
}
export interface CapabilityGrantInput {
    id: string;
    capabilityId: string;
    controls: CapabilityControl[];
    reason?: string;
    expiresInMinutes?: number;
    now?: Date;
    /** See `CapabilityGrant.commandAllowlist`. */
    commandAllowlist?: string[];
}
export interface CapabilityEvaluation {
    capabilityId: string;
    decision: 'allow' | 'ask' | 'deny';
    posture: CapabilityPosture;
    reason: string;
    missingControls: CapabilityControl[];
}
export declare const CAPABILITY_POLICIES: CapabilityPolicy[];
export declare function listCapabilityPolicies(): CapabilityPolicy[];
export declare function summarizeCapabilityAlignment(policies?: CapabilityPolicy[]): Record<CapabilityPosture, number>;
export declare function evaluateCapabilityPolicy(input: CapabilityEvaluationInput, policies?: CapabilityPolicy[]): CapabilityEvaluation;
export declare function createCapabilityGrant(input: CapabilityGrantInput, policies?: CapabilityPolicy[]): {
    grant?: CapabilityGrant;
    evaluation: CapabilityEvaluation;
};
export declare function evaluateCapabilityGrant(capabilityId: string, grants: CapabilityGrant[], options?: {
    now?: Date;
    killSwitchActive?: boolean;
}, policies?: CapabilityPolicy[]): CapabilityEvaluation;
export declare function listActiveCapabilityGrants(grants: CapabilityGrant[], now?: Date): CapabilityGrant[];
export declare function isCapabilityGrantActive(grant: CapabilityGrant, now?: Date): boolean;
export declare function revokeCapabilityGrant(grants: CapabilityGrant[], grantId: string, now?: Date): CapabilityGrant[];
export declare function findExpiredGrants(grants: CapabilityGrant[], now?: Date): CapabilityGrant[];
export declare function sanitizeCapabilityGrants(value: unknown, policies?: CapabilityPolicy[]): CapabilityGrant[];
/**
 * Returns true when at least one active grant for `capabilityId` has a
 * commandAllowlist entry that matches `command`. Used by the automation
 * runner to admit operator-approved scripts that fall outside the static
 * preset list.
 */
export declare function commandMatchesGrantAllowlist(capabilityId: string, grants: CapabilityGrant[], command: string, now?: Date): {
    matched: boolean;
    grantId?: string;
    pattern?: string;
};
export declare function mapToolsToCapabilityCoverage(): Record<string, string[]>;
export declare function autoGrantGatedCapabilities(existingGrants: CapabilityGrant[], now?: Date): CapabilityGrant[];
//# sourceMappingURL=capabilities.d.ts.map