/**
 * Action implementations for CLI.4 — `opensquid permissions …`.
 *
 * Split out of `permissions.ts` (file-size budget). Four verbs:
 *
 *   list     — show declared permissions per pack alongside user overrides.
 *              When `--pack <id>` is passed, scope to that one pack;
 *              otherwise enumerate every pack under
 *              `~/.opensquid/packs/`. Output is JSON (one entry per
 *              capability the pack declares OR has overrides for) so
 *              downstream tools can pipe it; the human-readable summary
 *              line is on stderr for ergonomics.
 *
 *   audit    — query `~/.opensquid/permission_audit.jsonl` (file-based;
 *              CLI.5 migrates to the libsql `audit_log` table). Honors
 *              `--since <duration>` (e.g. 24h, 7d) + `--decision <kind>`
 *              (allowed|denied|prompted). Returns rows sorted newest-first.
 *
 *   grant    — append a user-side override to
 *              `~/.opensquid/permission_overrides.yaml`. Rejects targets
 *              that match the sealed built-in denylist unless
 *              `OPENSQUID_TRUST_BUILTIN_DENY=0` is set in the environment.
 *              Atomic file write: tmp + rename.
 *
 *   revoke   — remove a matching override. Without `--target`, removes
 *              all overrides for `(pack, capability)`. With `--target`,
 *              removes only the matching `(pack, capability, target)`.
 *
 * Capability-vocabulary discipline: the CLI speaks the same `(pack,
 * capability, target)` tuple the runtime gate consumes. No translation
 * between human + machine vocabularies — the audit-log shape and the
 * gate's `CapabilityRequest` are literally the same triple.
 *
 * Imports from: ../../packs/schemas, ./permissions_state.
 * Imported by: src/setup/cli/permissions.ts.
 */
import { type CapabilityType } from '../../packs/schemas/index.js';
import { type AuditEntry } from './permissions_state.js';
export interface PermissionsPaths {
    overridesPath: string;
    auditPath: string;
    packsDir: string;
}
export interface ActionDeps {
    paths: PermissionsPaths;
    out: (s: string) => void;
    err: (s: string) => void;
    now: () => Date;
}
export declare const defaultPaths: () => PermissionsPaths;
export declare function parseCapability(raw: string): CapabilityType | null;
export interface ListOpts {
    pack?: string;
}
export declare function actList(deps: ActionDeps, opts: ListOpts): Promise<void>;
export interface AuditOpts {
    since?: string;
    decision?: string;
    limit?: string;
}
export declare function parseDurationToMs(spec: string): number | null;
export declare function actAudit(deps: ActionDeps, opts: AuditOpts): Promise<void>;
export interface GrantOpts {
    target: string;
}
export declare function actGrant(deps: ActionDeps, pack: string, capability: string, opts: GrantOpts): Promise<void>;
export interface RevokeOpts {
    target?: string;
}
export declare function actRevoke(deps: ActionDeps, pack: string, capability: string, opts: RevokeOpts): Promise<void>;
export declare function recordAuditEntry(path: string, entry: AuditEntry): Promise<void>;
//# sourceMappingURL=permissions_actions.d.ts.map