/**
 * @name signer/wallet-guard
 * @description Redacted wallet capability surface for local SAP MCP signing.
 *
 * Agents should reason about local signing as a capability, not as a file path.
 * This module intentionally reports readiness, storage class, permission hints,
 * and forbidden actions without returning keypair paths or secret material.
 *
 * @module signer/wallet-guard
 */
import type { SapMcpConfig } from '../../config-runtime/src/env.js';
export type WalletStorageClass = 'none' | 'local-keypair-file' | 'external-signer' | 'encrypted-local-keypair' | 'readonly';
export type WalletPermissionStatus = 'not-configured' | 'missing' | 'owner-only' | 'group-or-world-readable' | 'unknown';
export interface WalletGuardSummary {
    model: 'capability-only-local-signer';
    storage: WalletStorageClass;
    activeProfile?: string;
    signerPublicKey?: string;
    wallet: {
        configured: boolean;
        exists: boolean;
        path: '[REDACTED]' | 'not-configured';
        permissions: WalletPermissionStatus;
    };
    secretMaterial: 'keypair-bytes-never-returned';
    hostedVisibility: 'not-visible-to-hosted-accountless-server';
    agentVisibleCapabilities: readonly string[];
    forbiddenAgentActions: readonly string[];
    recommendedFlow: readonly string[];
    warnings: readonly string[];
}
export interface WalletGuardAudit {
    action: string;
    signerPublicKey?: string;
    intentId?: string;
    custody: 'user-local';
    secretMaterial: 'never-exposed-to-hosted-server';
    signerAccess: 'capability-only';
    forbidden: readonly string[];
}
export declare function walletGuardForbiddenActions(): readonly string[];
export declare function buildWalletGuardAudit(action: string, signerPublicKey?: string, intentId?: string): WalletGuardAudit;
export declare function buildWalletGuardSummary(config: Partial<SapMcpConfig> | undefined, options?: {
    activeProfile?: string;
    signerPublicKey?: string;
}): WalletGuardSummary;
//# sourceMappingURL=wallet-guard.d.ts.map