import { PolicyLayer, Verb } from "./PolicyTypes.js";
/**
 * Environment-variable policy layers.
 *
 * `NEX_POLICY_DENY` sits at the top of the ladder and cannot be granted past.
 * `NEX_POLICY_ALLOW` sits near the bottom and exists for backward compatibility, so an
 * existing CI job can restore its previous behaviour with one variable rather than
 * editing every command line.
 *
 * Named `NEX_POLICY_*` rather than `NEX_ALLOW_WRITE` because `write` and `execute`
 * collide with ServiceNow ACL vocabulary, and a reader should not have to work out
 * whether this is about ACLs.
 */
export declare const DENY_ENV = "NEX_POLICY_DENY";
export declare const ALLOW_ENV = "NEX_POLICY_ALLOW";
export interface ParsedVerbs {
    readonly verbs: readonly Verb[];
    /** Tokens that were not recognised. Non-empty means the value was malformed. */
    readonly unknown: readonly string[];
}
/**
 * Parses a comma-separated verb list.
 *
 * `all` expands to every verb. Unrecognised tokens are REPORTED rather than dropped, so
 * the caller can fail closed — see `denyFromEnvironment`.
 */
export declare function parseVerbList(raw: string | undefined): ParsedVerbs;
/**
 * The deny layer, built from `NEX_POLICY_DENY`.
 *
 * FAILS CLOSED on a malformed value. `NEX_POLICY_DENY=wrtie` denies everything and
 * warns, rather than silently denying nothing — a typo in the variable that is supposed
 * to protect production must not quietly disable the protection. That is the whole
 * reason this function reports `unknown` instead of filtering it away.
 *
 * Returns `undefined` when the variable is unset, so the layer is simply absent.
 */
export declare function denyFromEnvironment(env?: NodeJS.ProcessEnv, warn?: (message: string) => void): PolicyLayer | undefined;
/**
 * The backward-compatibility grant layer, built from `NEX_POLICY_ALLOW`.
 *
 * Unrecognised tokens here are dropped with a warning rather than failing closed: this
 * variable only ever *grants*, so a typo already fails safe — the operation is refused
 * and the operator sees why.
 */
export declare function allowFromEnvironment(env?: NodeJS.ProcessEnv, warn?: (message: string) => void): PolicyLayer | undefined;