/**
 * login-gate enforcer (L2.2 P1) — verifies destructive / auth-required
 * paths require explicit user confirmation.
 *
 * Two red lines:
 *   - rl-login-gate-001: destructive paths (uninstall, drop, force-push) must
 *     require user confirmation
 *   - rl-login-gate-002: protected paths (auth-required) must check session
 *
 * This is a static-check enforcer: the actual runtime gate is in
 * `peaks mode-enforcement` (the requireUserConfirmation function). The
 * catalog entry points to this file; the audit flags it as cli-backed
 * when the integration is wired (L2.2 ships the wiring).
 */
export interface LoginGateInput {
    readonly command: string;
}
export interface LoginGateResult {
    readonly destructive: boolean;
    readonly protected: boolean;
    readonly matchedPattern: string | null;
}
export declare function checkLoginGate(input: LoginGateInput): LoginGateResult;