import { getToken } from "@vercel/connect";
import type { SandboxSession } from "eve/sandbox";
export interface GitHubPermission {
    readonly access: "write";
    readonly provider: "github";
    readonly repositories: readonly string[];
}
export interface GitHubShellInput {
    readonly command: string;
    readonly description: string;
    readonly permissions: readonly GitHubPermission[];
    readonly workingDirectory?: string;
}
export interface GitHubShellOutput {
    readonly exitCode: number;
    readonly stderr: string;
    readonly stdout: string;
    readonly truncated: boolean;
}
export interface GitHubConfig {
    readonly broker: (sandbox: SandboxSession, rules: Readonly<Record<string, readonly GitHubLeaseRule[]>> | null) => Promise<void>;
    readonly connector: string;
    readonly org: string;
}
export interface GitHubLeaseRule {
    readonly match?: {
        readonly headers?: readonly {
            readonly key?: {
                readonly exact: string;
            };
            readonly value?: {
                readonly exact?: string;
                readonly regex?: string;
            };
        }[];
    };
    readonly transform: readonly {
        readonly headers: Readonly<Record<string, string>>;
    }[];
}
interface GitHubShellDependencies {
    readonly getConnectToken?: typeof getToken;
    readonly getSandbox: () => Promise<SandboxSession>;
    /** Serializes credential leases per eve session; every `ctx.getSandbox()` call returns a new handle. */
    readonly sessionId: string;
}
export declare function githubShellApproval(input: GitHubShellInput | undefined): "not-applicable" | {
    type: "denied";
    reason: string;
};
export declare function executeGitHubShell(input: GitHubShellInput, config: GitHubConfig | undefined, dependencies: GitHubShellDependencies): Promise<GitHubShellOutput>;
export declare function parseCommand(command: string): string[];
export {};