/**
 * Capability gate (AUTO.3) — POSIX-style declared-capability check.
 * Spec: `docs/tasks/automation.md` AUTO.3.
 *
 * Precedence: builtin-deny → pack-deny → pack-allow → prompt → deny+audit.
 * Engine-vocabulary: gate speaks in `(pack, capability, target)` only.
 *
 * Risk postures (locked at AUTO.3):
 *   - Shell metacharacters (`; && || $() backticks | > >> <(`) blanket-
 *     reject unless the exact raw command is in the allowlist; SEC.4 ships
 *     full `shell-quote` argv parser.
 *   - HTTP allowlist match is on `new URL(target).hostname` (never glob on
 *     raw URL — foot-gun: `api.github.com.attacker.com`).
 *   - Parse failures + prompt-throw + audit-throw all DENY (constraint C10).
 *
 * Audit: every verdict flows through `auditLog`. CLI.5 lands the libsql
 * `audit_log` table; AUTO.3 ships the interface (no-op default).
 */
import type { Capability, PermissionsType } from '../packs/schemas/index.js';
export interface CapabilityRequest {
    pack: string;
    capability: Capability;
    target: string;
    method?: string;
    context?: Record<string, unknown>;
}
export interface CapabilityVerdict {
    allowed: boolean;
    source: 'declared' | 'user_approved' | 'user_override' | 'denied' | 'denylist';
    message?: string;
}
export type PromptCallback = (req: CapabilityRequest) => Promise<boolean>;
export type AuditLog = (verdict: CapabilityVerdict, req: CapabilityRequest) => void;
export interface PackPermissions {
    name: string;
    permissions?: PermissionsType;
}
/**
 * User-side capability override (CLI.4). Persisted in
 * `~/.opensquid/permission_overrides.yaml` and merged into the gate by
 * `applyOverrides()` (see `src/setup/cli/permissions_state.ts`).
 *
 * Each override grants `(pack, capability, target-glob)`. The CLI is
 * forbidden from persisting overrides that match the built-in denylist —
 * the gate still applies its built-in deny FIRST, so even a malicious
 * write to the overrides file can never escape the sealed denylist
 * unless `OPENSQUID_TRUST_BUILTIN_DENY=0` is set.
 */
export interface UserOverride {
    pack: string;
    capability: Capability;
    target: string;
}
export interface CapabilityGateOpts {
    packs: Map<string, PackPermissions>;
    prompt?: PromptCallback;
    auditLog?: AuditLog;
    /** Snapshot of env-var trust flag (constant per-instance). */
    trustBuiltinDeny?: boolean;
    /** Override `~/...` expansion target (defaults to os.homedir()). */
    homeDir?: string;
    /**
     * User-side overrides (CLI.4). Applied AFTER built-in deny + pack
     * deny, BEFORE pack allowlist. Override-matched verdicts carry
     * `source: 'user_override'` for audit-log triage.
     */
    overrides?: readonly UserOverride[];
}
export declare class CapabilityGate {
    private readonly packs;
    private readonly prompt;
    private readonly auditLogFn;
    private readonly trustBuiltinDeny;
    private readonly homeDir;
    private readonly overrides;
    constructor(opts: CapabilityGateOpts);
    check(req: CapabilityRequest): Promise<CapabilityVerdict>;
    private matchOverride;
    private matchBuiltinDeny;
    private matchPackDeny;
    private matchPathList;
    private matchAllowlist;
    private handleUndeclared;
    private audit;
}
//# sourceMappingURL=capability_gate.d.ts.map