import type { CommandResolution, ExecAllowlistEntry, ExecApprovalsDefaultOverrides, ExecApprovalsFile, ExecApprovalsResolved } from "./exec-approvals-types.js";
/**
 * Resolves the fully merged exec-approval settings for a given koi,
 * combining file defaults, wildcard koi, and koi-specific overrides.
 */
export declare function resolveExecApprovals(koiId?: string, overrides?: ExecApprovalsDefaultOverrides): ExecApprovalsResolved;
/** Pure version of {@link resolveExecApprovals} that takes an already-loaded file. */
export declare function resolveExecApprovalsFromFile(params: {
    file: ExecApprovalsFile;
    koiId?: string;
    overrides?: ExecApprovalsDefaultOverrides;
    path?: string;
    socketPath?: string;
    token?: string;
}): ExecApprovalsResolved;
/**
 * Parses the first token from a shell command string and resolves its
 * executable path via PATH lookup. Used for allowlist matching.
 */
export declare function resolveCommandResolution(command: string, cwd?: string, env?: NodeJS.ProcessEnv): CommandResolution | null;
export declare function resolveCommandResolutionFromArgv(argv: string[], cwd?: string, env?: NodeJS.ProcessEnv): CommandResolution | null;
export declare function resolveAllowlistCandidatePath(resolution: CommandResolution | null, cwd?: string): string | undefined;
/**
 * Checks whether a resolved command matches any allowlist entry by path pattern.
 * @returns The matching entry, or null if no match found.
 */
export declare function matchAllowlist(entries: ExecAllowlistEntry[], resolution: CommandResolution | null): ExecAllowlistEntry | null;