/**
 * @fileoverview Audit exclusions loader + matcher + tier-revalidation gate
 * (SMI-4590 Wave 4 PR 3).
 * @module @skillsmith/core/audit/exclusions
 *
 * Reads `~/.skillsmith/audit-exclusions.json` and provides {@link isExcluded}
 * for the inventory collision detector to filter known-acceptable findings,
 * plus {@link tierAllowsAuditMode} — the write-time / re-resolution gate the
 * CLI (PR 5) and session-start hook (PR 6) call before persisting or
 * applying a user-selected `audit_mode`.
 *
 * Failure modes (decision #13 verbatim):
 *   - Missing file → empty config; nothing filtered.
 *   - Unreadable / malformed JSON → warn-and-empty; no exception.
 *   - Unknown `version` → warn-and-empty (forward-compat).
 *
 * Exclusion match is exact-string per `kind`. No glob / prefix support in
 * v1 — keep the surface small until users ask.
 */
import type { AuditMode, Tier } from '../config/audit-mode.js';
import type { ExcludableEntry, ExclusionsConfig } from './exclusions.types.js';
/**
 * Resolve the absolute path to the exclusions file. Defaults to
 * `~/.skillsmith/audit-exclusions.json`. Tests pass `configDir` to
 * isolate.
 */
export declare function getExclusionsPath(opts?: {
    configDir?: string;
}): string;
export interface LoadExclusionsOptions {
    /**
     * Override the file path. Defaults to {@link getExclusionsPath}().
     * Test harnesses pass a temp-dir path; production callers should leave
     * unset.
     */
    configPath?: string;
}
/** Load the exclusions config. Never throws; failures degrade to empty. */
export declare function loadExclusions(opts?: LoadExclusionsOptions): Promise<ExclusionsConfig>;
/** True when `entry` matches any exclusion in `config`. Exact-match only. */
export declare function isExcluded(entry: ExcludableEntry, config: ExclusionsConfig): boolean;
/**
 * Tier-revalidation gate for `audit_mode` writes (Wave 4 plan §8).
 *
 * Applied at three points (defense-in-depth):
 *   1. CLI write-time: `sklx config set audit_mode <value>` (PR 5)
 *      rejects with typed error `audit.mode.tier_ineligible` when this
 *      returns false.
 *   2. Session-start hook (PR 6): re-resolves to `'preventative'` when
 *      a manually-edited config violates the gate.
 *   3. Detector entry-point: hardening boundary in case (1) and (2)
 *      both miss.
 *
 * Eligibility table:
 *
 *   |              | preventative | power_user | governance | off |
 *   |--------------|:------------:|:----------:|:----------:|:---:|
 *   | community    |      ✓       |     ✗      |     ✗      |  ✓  |
 *   | individual   |      ✓       |     ✗      |     ✗      |  ✓  |
 *   | team         |      ✓       |     ✓      |     ✗      |  ✓  |
 *   | enterprise   |      ✓       |     ✓      |     ✓      |  ✓  |
 *
 * `'off'` is allowed for all tiers — turning the audit off is a user
 * preference, not a paid capability.
 */
export declare function tierAllowsAuditMode(tier: Tier, mode: AuditMode): boolean;
//# sourceMappingURL=exclusions.d.ts.map