import type { TrustPolicy } from "./policy.js";
/**
 * Structured details on why a source failed trust validation.
 *
 * The lib never adds CLI hints or vendor copy to the error message — hosts
 * read these fields and render whatever guidance is appropriate for their
 * surface (`npx <host-cli> trust add ...`, a UI prompt, a structured log).
 */
export interface TrustErrorDetails {
    /** The original source string that was rejected. */
    source: string;
    /** What kind of source it is, after parsing. */
    kind: "github" | "git" | "well-known";
    /** Owner segment when applicable (e.g. GitHub org). */
    owner?: string;
    /** Repo segment when applicable. */
    repo?: string;
    /** Hostname (or host+port) of the offending URL. */
    domain?: string;
    /** A snapshot of the policy that rejected the source. */
    allowed: TrustPolicy;
}
export declare class TrustError extends Error {
    readonly details: TrustErrorDetails;
    constructor(message: string, details: TrustErrorDetails);
}
/**
 * Extract domain from a git URL.
 *
 * Supports:
 *   https://host.com/...  → host.com
 *   ssh://host.com/...    → host.com
 *   git://host.com/...    → host.com
 *   git@host.com:...      → host.com
 *   file:///...           → (no domain)
 */
export declare function extractDomain(url: string): string | undefined;
export declare function extractDomainPath(url: string): string | undefined;
/**
 * Validate that a source specifier is allowed by the trust configuration.
 *
 * - No trust config → allow all (backward compat)
 * - allow_all = true → allow all
 * - Local path: sources → always allowed
 * - Otherwise → must match at least one rule (org, repo, or domain)
 */
export declare function validateTrustedSource(source: string, trust?: TrustPolicy): void;
//# sourceMappingURL=validator.d.ts.map