/**
 * SMI-4396: Imported-skills security allowlist.
 *
 * Loads data/skills-security-allowlist.json and produces an AllowlistMatcher
 * that shouldQuarantine + scanSkill consult to drop known false-positive
 * findings from the quarantine predicate.
 *
 * Design invariants:
 * - Per-(skillId, findingType, messagePattern, matchField) scope — never whole-skill bypass.
 * - 90-day expiry enforced at match time; expired entries behave as absent.
 * - ReDoS-hardened: load-time regex validation rejects nested quantifiers and
 *   unbounded wildcards; runtime uses safeRegexTest with length cap.
 * - Fail-safe toward quarantine: malformed entries throw at load; unknown
 *   matchField rejects.
 * - Governance review L-4 (SMI-5207): the default `matchField: 'message'` is no
 *   longer 100% scanner-derived text. Since SMI-5207, `sensitive_path`
 *   findings' `message` embeds up to 60 characters of the matched span from
 *   the skill's OWN content (SecurityScanner.scanners.ts), so a skill that
 *   already holds an allowlist entry could in principle craft matched text
 *   widening that entry's reach across its own findings of the same type —
 *   the per-skillId scope bounds this to no cross-skill bypass. New entries
 *   for message-embedding finding types should scope `messagePattern` against
 *   `pattern.source` (the fixed regex-source suffix every message carries),
 *   not the quoted span, matching the existing entries' own convention.
 */
import type { AllowlistEntry, AllowlistFile, AllowlistMatcher } from './types.js';
/**
 * Parse a raw allowlist file object. Throws on malformed shape, invalid
 * dates, unsafe regex, or missing required fields.
 */
export declare function parseAllowlistFile(raw: unknown): AllowlistFile;
/** Reset expiry-warning dedupe cache. Exposed for tests. */
export declare function _resetExpiryWarningCache(): void;
/**
 * Empty matcher — returns false for every check. Used when the allowlist file
 * is absent and for callers that want to opt out without conditional plumbing.
 */
export declare const EMPTY_ALLOWLIST: AllowlistMatcher;
/**
 * Load + validate an allowlist JSON file and return a matcher.
 *
 * If `path` does not exist, returns EMPTY_ALLOWLIST. A malformed file throws
 * (fail-safe toward quarantine — never silently skip validation).
 */
export declare function loadAllowlist(path: string): AllowlistMatcher;
/** Build a matcher from an in-memory entry list (test + inline use). */
export declare function buildMatcher(entries: AllowlistEntry[]): AllowlistMatcher;
//# sourceMappingURL=allowlist.d.ts.map