/**
 * Skills trust model.
 *
 * Tier is derived from `source.type` at discovery time and is stored on every
 * `ParsedSkill` as `trustTier`. The collapsed 3-tier vocabulary
 * (`'trusted' | 'operator' | 'third-party'`) maps the conceptual 4-tier
 * (`bundled | project | user | third-party`) onto the policy boundary the SDK
 * actually applies — bundled / project / config collapse to `'trusted'`,
 * `user` is `'operator'` (trusted by default, distinct only for telemetry
 * and policy tightening), and `package` / `cli-fetched` are `'third-party'`.
 * This module reads the existing `trustTier` field rather than
 * re-classifying.
 *
 * `trustedSources` is the opt-in allowlist that elevates third-party sources
 * to the same policy as trusted ones. Entries key on **immutable source
 * identity**:
 *
 *   - npm package name (`'@anthropic-skills/core'`) for `package` sources.
 *   - Full source-spec key (`'package:@anthropic-skills/core'`,
 *     `'cli-fetched:<ref>'`, `'config:<basename>'`) for the discriminated
 *     forms.
 *   - The literal strings `'project'`, `'user'`, `'bundled'` (already
 *     trusted by default — accepted for forward-compat and explicit allow).
 *
 * Wildcards (`*`) are not supported. The author-declared `vendor:`
 * frontmatter field is **never** consulted for trust — that field is for
 * namespacing only.
 */
import type { ParsedSkill, SkillSource } from './types.js';
/**
 * Trust-related error thrown at construction time when `SkillsConfig.trustedSources`
 * is malformed (e.g., wildcards, unmatched entries). Surfaces through the
 * `SkillsManager` constructor so misconfiguration is loud.
 */
export declare class SkillsTrustConfigError extends Error {
    readonly entry: string;
    constructor(entry: string, reason: string);
}
/**
 * Stable identity string for a `SkillSource`. Used both to compute the
 * `trustedSources` lookup key and to validate `trustedSources` entries
 * against the configured `sources` list. The output mirrors the manager's
 * internal `sourceIdentity()` helper: `<type>:<discriminator>`, with a few
 * shortcuts for the discriminator-less variants (`'project'`, `'user'`,
 * `'bundled'`) that match the literal tier names a configurer is likely
 * to type.
 */
export declare function sourceIdentityKey(source: SkillSource): string;
/**
 * Validate that every `trustedSources` entry matches a known source
 * identity. Returns the normalized set of identity keys; throws
 * `SkillsTrustConfigError` on wildcards, empty strings, or unmatched
 * entries.
 */
export declare function validateTrustedSources(trustedSources: readonly string[] | undefined, configuredSources: readonly SkillSource[]): ReadonlySet<string>;
/**
 * Decide whether a skill is trusted enough to honor its declarative
 * affordances (`allowed-tools`, `disable-model-invocation: false`,
 * `hooks`).
 *
 * Rules:
 *
 *   - `trustTier === 'trusted'` (`project`/`config`/`bundled`) → always trusted.
 *   - `trustTier === 'operator'` (`user`) → trusted by default. The operator
 *     is the user running the SDK on their own box; treating their own files
 *     as untrusted would require a flag they'd never set.
 *   - `trustTier === 'third-party'` (`package`/`cli-fetched`) → trusted iff
 *     the skill's source identity is in `trustedSourceIdentities` (the
 *     pre-validated `Set` returned by `validateTrustedSources`).
 */
export declare function isSkillTrusted(skill: ParsedSkill, trustedSourceIdentities: ReadonlySet<string>): boolean;
//# sourceMappingURL=trust.d.ts.map