/**
 * Plugin capability manifest validation and resolution.
 *
 * Implements deny-by-default capability enforcement:
 * 1. Parse raw manifest capabilities (unknown → typed)
 * 2. Validate that each requested capability is a known capability
 * 3. Run the runtime's capability policy to grant or deny each capability
 * 4. Return a resolved PluginCapabilityManifest
 */
import { type PluginCapability, type PluginCapabilityManifest, type PluginManifestV2 } from './types.js';
import { type PluginTrustTier } from './trust.js';
/**
 * resolveCapabilityManifest, Parse and resolve the capability manifest for a
 * plugin, applying the runtime's capability policy and trust-tier constraints.
 *
 * Evaluation order:
 *   1. Unknown capability strings are filtered out (warn + ignore).
 *   2. Trust-tier constraints are applied, high-risk capabilities blocked
 *      unless the plugin has the `trusted` tier.
 *   3. The runtime capability policy callback is applied to the remaining set.
 *
 * @param pluginName - Plugin name (for logging).
 * @param manifest   - The raw plugin manifest (may have `capabilities` array).
 * @param policy     - Capability grant/deny callback. Defaults to permissive.
 * @param trustTier  - Effective trust tier for this plugin. Defaults to 'untrusted'.
 * @returns A fully-resolved PluginCapabilityManifest.
 */
export declare function resolveCapabilityManifest(pluginName: string, manifest: PluginManifestV2, policy?: (name: string, cap: PluginCapability) => boolean, trustTier?: PluginTrustTier): PluginCapabilityManifest;
/**
 * isHighRiskCapability, Returns whether a capability is classified as high-risk.
 * High-risk capabilities require the `trusted` tier to be granted.
 */
export declare function isHighRiskCapability(capability: PluginCapability): boolean;
/**
 * hasCapability, Returns whether a plugin has been granted a specific
 * capability after manifest resolution.
 */
export declare function hasCapability(manifest: PluginCapabilityManifest, capability: PluginCapability): boolean;
/**
 * validateManifestV2, Light validation of the PluginManifestV2 shape.
 * Returns null on success or an error string on failure.
 */
export declare function validateManifestV2(manifest: unknown): string | null;
//# sourceMappingURL=manifest.d.ts.map