import { type PluginLoaderDeps, type PluginPathOptions } from './loader.js';
import { type PluginTrustTier, type PluginTrustRecord, type SignatureValidationResult } from '../runtime/plugins/trust.js';
import { type QuarantineRecord } from '../runtime/plugins/quarantine.js';
/**
 * PluginStatus, Public-facing plugin info for /plugin list.
 */
export interface PluginStatus {
    name: string;
    version: string;
    description: string;
    author?: string | undefined;
    enabled: boolean;
    active: boolean;
    /** Trust tier for this plugin. */
    trustTier: PluginTrustTier;
    /** Whether this plugin is currently quarantined. */
    quarantined: boolean;
}
export interface PluginManagerObserver {
    subscribe(callback: () => void): () => void;
    list(): PluginStatus[];
    capabilities(name: string): {
        ok: boolean;
        error?: string | undefined;
        requested: string[];
        highRisk: string[];
        safe: string[];
        tier: PluginTrustTier;
        blocked: string[];
    } | null;
    getTrustRecord(name: string): Readonly<PluginTrustRecord> | undefined;
    getQuarantineRecord(name: string): Readonly<QuarantineRecord> | undefined;
}
export interface PluginManagerOptions {
    readonly pathOptions: PluginPathOptions;
    readonly stateFilePath?: string | undefined;
}
/**
 * PluginManager, orchestrates plugin discovery, loading, and persistence.
 */
export declare class PluginManager {
    private plugins;
    private state;
    private deps;
    /** Trust store, manages tier records for all plugins. */
    private readonly trustStore;
    /** Quarantine engine, manages plugin quarantine state. */
    private readonly quarantineEngine;
    private readonly subscribers;
    private readonly pathOptions;
    private readonly stateFilePath;
    constructor(options: PluginManagerOptions);
    /**
     * init, Must be called once at startup with application dependencies.
     * Loads state from disk, then discovers and loads all enabled plugins.
     */
    init(deps: PluginLoaderDeps): Promise<void>;
    /** Returns status for all discovered plugins (enabled or not). */
    list(): PluginStatus[];
    subscribe(callback: () => void): () => void;
    getTrustRecord(name: string): Readonly<PluginTrustRecord> | undefined;
    getQuarantineRecord(name: string): Readonly<QuarantineRecord> | undefined;
    /**
     * trust, Set the trust tier for a plugin.
     *
     * For the `trusted` tier, prefer `trustSigned()` which also validates the
     * signature. This method is for operator-forced tier assignment.
     */
    trust(name: string, tier: PluginTrustTier, note?: string | undefined): {
        ok: boolean;
        error?: string;
    };
    /**
     * trustSigned, Elevate a plugin to `trusted` after validating its manifest signature.
     */
    trustSigned(name: string, publicKey?: string): {
        ok: boolean;
        fingerprint?: string | undefined;
        error?: string;
    };
    /**
     * verify, Inspect a plugin's manifest signature without changing its tier.
     */
    verify(name: string, publicKey?: string): {
        ok: boolean;
    } & SignatureValidationResult;
    /**
     * capabilities, Return the capability information for a plugin.
     *
     * Returns the full set: requested, granted (based on current trust tier),
     * denied, and which capabilities are high-risk.
     */
    capabilities(name: string): {
        ok: boolean;
        error?: string | undefined;
        requested: string[];
        highRisk: string[];
        safe: string[];
        tier: PluginTrustTier;
        blocked: string[];
    } | null;
    /**
     * quarantine, Apply quarantine to a plugin.
     *
     * This is the high-level operator path. It resolves the plugin's declared
     * capability manifest using the current trust tier, then applies quarantine
     * immediately to the resolved capability set.
     */
    quarantine(name: string, reason: string): {
        ok: boolean;
        error?: string;
    };
    /**
     * liftQuarantine, Remove quarantine from a plugin.
     */
    liftQuarantine(name: string): {
        ok: boolean;
        error?: string;
    };
    /** Enable a plugin by name. Loads it immediately if deps are available. */
    enable(name: string): Promise<{
        ok: boolean;
        error?: string;
    }>;
    /** Disable a plugin by name. Deactivates it immediately if active. */
    disable(name: string): Promise<{
        ok: boolean;
        error?: string;
    }>;
    /** Reload all currently enabled plugins (deactivate then reactivate). */
    reload(): Promise<{
        reloaded: number;
        failed: number;
    }>;
    /** Returns whether a plugin is marked as enabled in persisted state. */
    isEnabled(name: string): boolean;
    /** Returns plugin-specific config for a given plugin name. */
    getPluginConfig(name: string): Record<string, unknown>;
    private loadEnabledPlugins;
    private loadState;
    private saveState;
    private discoverPlugins;
    private findDiscoveredPlugin;
    private notFoundError;
    private describeSearchDirectories;
    private notifySubscribers;
}
//# sourceMappingURL=manager.d.ts.map