/**
 * Structural capability analysis — the firewall's answer to adaptive attacks.
 *
 * Pattern matching anchors on literal tokens; attackers defer those tokens to
 * runtime (`c?rl` globs to curl, `$p$q` concatenates to curl, `$(printf 's\x64a')`
 * builds `sda`). So instead of matching surface text we (1) RESOLVE the command
 * symbolically — undo the shell tricks the way the shell would — and then (2)
 * judge by CAPABILITY: does this *do* a fetch-and-execute, open a reverse shell,
 * read a secret and send it somewhere? Capabilities survive token-level evasion
 * because they describe behaviour, not spelling.
 *
 * This is still not a sandbox (shell is Turing-complete), but it closes the whole
 * family of "rename the tool / split the token / build it at runtime" bypasses
 * that defeat regex, and it generalizes to variants it has never seen.
 */
export type Cap = {
    id: string;
    decision: "deny" | "ask";
    label: string;
};
/**
 * Reveal a command's true intent past the shell tricks adaptive attackers use:
 * variable concatenation, globbed binary names, parameter expansion of `$HOME`,
 * `$(printf '\xNN')` byte-building, quote/backslash/IFS splitting. Best-effort and
 * bounded — it models the common evasions, not the whole shell grammar.
 */
export declare function resolveCommand(cmd: string): string;
/** Run every capability detector over a RESOLVED command (or file content). */
export declare function detectCommandCapabilities(resolved: string): Cap[];
/** Capabilities embedded in file CONTENT (a build file / config / script the
 *  agent is asked to write). Fetch-and-execute or a reverse shell baked into a
 *  file is persistence/RCE regardless of the file's path. Scans both the raw
 *  content and its resolved form so neither quote-stripping nor obfuscation hides
 *  the behaviour. */
export declare function detectContentCapabilities(content: string): Cap[];