/**
 * tool-trust — executable-tool trust policies for project-local and installed
 * npm tools (release launch, Phase 3 Task 3.2; audit remediation).
 *
 * A `project-local` tool is authored code under `<project>/opensip-cli/…`
 * that changes with the repo (§5.2.1). Running it imports arbitrary code
 * from the working tree, so the host MUST make the trust decision explicit
 * rather than load-by-presence.
 *
 * Policy for launch (signed off): **deny-by-default for non-interactive
 * runs; admit when an explicit project/user action recorded trust.** Project
 * authored tools use committed `tools.trusted`; managed npm installs use a
 * per-host trust record; env allowlists remain override/incident-response
 * mechanisms:
 *
 *   OPENSIP_CLI_ALLOW_PROJECT_TOOLS="my-audit, my-lint"    # override by exact id
 *   OPENSIP_CLI_ALLOW_PROJECT_TOOLS="*"                    # ignored (exact ids only)
 *
 * The decision is made BEFORE the tool's module is imported: a disallowed
 * project-local tool is fail-closed (exit 5) without its code ever running.
 */
/**
 * Environment variable carrying the project-local tool allowlist. Read
 * once per decision (cheap), never cached, so a test can set/unset it
 * around a single call.
 */
export declare const PROJECT_TOOL_ALLOWLIST_ENV = "OPENSIP_CLI_ALLOW_PROJECT_TOOLS";
/**
 * Environment variable carrying the installed-npm tool allowlist. Empty/unset
 * ⇒ deny-by-default for ambient `node_modules` discovery (paired with
 * {@link isInstalledToolTrusted}).
 */
export declare const INSTALLED_TOOL_ALLOWLIST_ENV = "OPENSIP_CLI_ALLOW_INSTALLED_TOOLS";
export type ToolTrustReason = 'bundled' | 'managed-install' | 'project-config' | 'env' | 'user-global' | 'denied';
export interface InstalledToolTrustRecord {
    readonly toolId: string;
    readonly packageName: string;
    readonly version?: string;
    readonly manifestHash: string;
    readonly installSourcePath: string;
    readonly installedAt: string;
}
export interface InstalledToolTrustDecision {
    readonly trusted: boolean;
    readonly reason: ToolTrustReason;
}
export declare function trustedToolIdsFromConfigDocument(document: unknown): ReadonlySet<string>;
export declare function readProjectTrustedToolIds(configPath: string | undefined): ReadonlySet<string>;
export declare function recordInstalledToolTrust(args: {
    readonly scope: 'global' | 'project';
    readonly cwd: string;
    readonly toolId: string;
    readonly packageName: string;
    readonly version?: string;
    readonly manifestHash: string;
    readonly installSourcePath: string;
    readonly installedAt?: Date;
}): void;
export declare function removeInstalledToolTrust(args: {
    readonly scope: 'global' | 'project';
    readonly cwd: string;
    readonly toolId: string;
    readonly packageName: string;
}): void;
export declare function resolveInstalledToolTrust(args: {
    readonly toolId: string;
    readonly packageName: string;
    readonly packageDir: string;
    readonly manifestHash?: string;
    readonly env?: NodeJS.ProcessEnv;
    readonly projectRoot?: string;
    readonly projectTrustedTools?: ReadonlySet<string>;
}): InstalledToolTrustDecision;
/**
 * Decide whether a project-local executable tool with the given `id` is
 * trusted to load, under the deny-by-default + allowlist-opt-in policy.
 *
 * **Env governance (pre-scope exception).** The allowlist var is declared as a
 * first-class `EnvVarSpec` in `CLI_ENV_SPECS`
 * (`OPENSIP_CLI_ALLOW_PROJECT_TOOLS`, `host-env-specs.ts`) — that declaration
 * is the documentation home, so it appears in the generated env-surface
 * reference. The read here stays on the INJECTED `env` param rather than
 * `hostEnv.get(...)`: this trust check runs at BOOTSTRAP, before any `RunScope`
 * exists, and the injectable seam is what keeps it unit-testable without
 * mutating global `process.env` (the same posture the repo takes for
 * `NODE_OPTIONS`). The `env-via-registry` guardrail is satisfied because this is
 * an injected-param read (`env[...]`), not a raw `process.env.<NAME>` read.
 *
 * @param id The tool's stable id (from its sidecar manifest).
 * @param env The environment to read the allowlist from (defaults to
 *   `process.env`; injectable for tests).
 * @returns `true` iff the allowlist contains the exact `id` (`*` is ignored).
 */
export declare function isProjectLocalToolTrusted(id: string, env?: NodeJS.ProcessEnv): boolean;
/**
 * Decide whether an installed npm tool with the given manifest `id` is trusted
 * to `import()` into the host process, under deny-by-default + allowlist-opt-in.
 *
 * Read timing and env governance mirror {@link isProjectLocalToolTrusted}: the
 * check runs at bootstrap before any `RunScope` exists, via the injected `env`
 * param for testability.
 *
 * @param id The tool's stable id (from `package.json#opensipTools.id`).
 * @param env The environment to read the allowlist from (defaults to
 *   `process.env`; injectable for tests).
 * @returns `true` iff the allowlist contains the exact `id` (`*` is ignored).
 */
export declare function isInstalledToolTrusted(id: string, env?: NodeJS.ProcessEnv): boolean;
//# sourceMappingURL=tool-trust.d.ts.map