import { type ExecAction, type PlanContext } from "../internals/plan.js";
export type TrustSource = LocalTrustSource | GitHubTrustSource;
export interface LocalTrustSource {
    kind: "local";
    id: string;
    source: string;
    root: string;
    display: string;
}
export interface GitHubTrustSource {
    kind: "github";
    id: string;
    source: string;
    owner: string;
    repo: string;
    ref: string;
    pin?: string;
    quarantineRoot: string;
    treePath: string;
    metadataPath: string;
    display: string;
}
export interface PackageTrustSource {
    kind: "package";
    id: string;
    source: string;
    package: string;
    version: string;
    integrity: string;
    registry: string;
    candidate: string;
    candidateSource: {
        type: "stdio";
        resolver: "npx" | "uvx";
        registry: string;
        package: string;
        version: string;
        integrity: string;
    };
    evidenceRecord: string;
    quarantineRoot: string;
    treePath: string;
    metadataPath: string;
    display: string;
}
export interface TrustFetchMetadata {
    kind: "github";
    owner: string;
    repo: string;
    ref: string;
    pinnedSha: string;
    source: string;
    treePath: string;
}
export declare function cleanupQuarantine(source: TrustSource | PackageTrustSource | undefined): Error | undefined;
export declare function scrubFetchEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
export declare function scrubDockerClientEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
export declare function isSafeGitRefName(ref: string): boolean;
export declare function resolveTrustSource(raw: string, opts?: {
    root: string;
    ref?: string;
    pin?: string;
    skipDirs?: ReadonlySet<string>;
}): TrustSource;
export declare function resolvePackageTrustSource(input: {
    package: string;
    version: string;
    integrity: string;
    registry: string;
    candidate: string;
    source: PackageTrustSource["candidateSource"];
    evidenceRecord: string;
}): PackageTrustSource;
/**
 * A first-party source: a LOCAL path resolved UNDER the repo root (e.g. a bundled
 * skill in `packs/`). First-party sources are graded on aih-native coverage
 * (skillVerdict) and marked on their approval (card + lockfile) for auditability;
 * a local path OUTSIDE the repo is NOT first-party.
 */
export declare function isFirstPartySource(root: string, source: TrustSource): boolean;
export declare function assertTrustTreeSafe(root: string, opts?: {
    skipDirs?: ReadonlySet<string>;
}): string;
export declare function readTrustFetchMetadata(source: GitHubTrustSource): TrustFetchMetadata;
export declare function trustFetchExec(source: GitHubTrustSource, ctx: PlanContext): ExecAction;
export declare function trustPackageFetchActions(source: PackageTrustSource, ctx: PlanContext): ExecAction[];
export declare function localFileHash(path: string): string;
export declare function safeSourceRelative(root: string, absPath: string): string;