/**
 * CLI.4 — `opensquid permissions list|audit|grant|revoke`.
 *
 * Thin commander wiring. Verb bodies live in `./permissions_actions.ts`;
 * persistence + denylist guard helpers in `./permissions_state.ts`. This
 * file ONLY routes commander options/args into the action functions and
 * resolves default paths from `OPENSQUID_HOME()`.
 *
 * Verb semantics (locked):
 *
 *   list    — show every installed pack's `manifest.permissions:` block
 *             alongside any user overrides for that pack. JSON-on-stdout
 *             so callers can `jq` it. `--pack <id>` scopes to one pack.
 *
 *   audit   — query `~/.opensquid/permission_audit.jsonl` with optional
 *             `--since <duration>` (24h, 7d, 30m, 60s) +
 *             `--decision <allowed|denied|prompted>` filters. Newest-
 *             first. CLI.5 swaps this file-based sink for the libsql
 *             `audit_log` table; the wire shape is a deliberate subset
 *             of the CLI.5 columns so migration is `INSERT INTO ...
 *             SELECT ...`.
 *
 *   grant   — append a user-side override to
 *             `~/.opensquid/permission_overrides.yaml` (atomic write).
 *             Built-in denylist patterns are REJECTED at the CLI layer
 *             with an explicit error message — even if a user edits
 *             the file directly, the gate still applies the sealed
 *             denylist first (defense in depth). Escape hatch:
 *             `OPENSQUID_TRUST_BUILTIN_DENY=0` disables BOTH layers
 *             (matching the gate's env snapshot semantics).
 *
 *   revoke  — remove matching overrides. Without `--target`, removes
 *             every override for `(pack, capability)`. With `--target`,
 *             removes only the exact `(pack, capability, target)` row.
 *
 * Imports from: commander, ./permissions_actions, ./permissions_state.
 * Imported by: src/cli.ts.
 */
import type { Command } from 'commander';
export interface PermissionsCliDeps {
    overridesPath?: string;
    auditPath?: string;
    packsDir?: string;
    stdout?: (s: string) => void;
    stderr?: (s: string) => void;
    now?: () => Date;
}
export declare function registerPermissions(parent: Command, deps?: PermissionsCliDeps): Command;
//# sourceMappingURL=permissions.d.ts.map