/**
 * `POST /api/sudo-approve` — the trusted-process approval endpoint.
 *
 * The in-browser broker (`packages/webapp/src/sudo/http-broker.ts`) POSTs the
 * gated action here; this process raises a genuine native dialog / TTY prompt
 * (the agent's browser `node` shim can't reach this process) and returns the
 * human's decision. Loopback-only, like the other local node-server endpoints.
 *
 * Fail closed: an invalid body → 400; a backend that throws → `deny` (200).
 * Requests never auto-resolve to allow.
 */
import { type Express } from 'express';
import type { SudoBackend } from './types.js';
export interface SudoEndpointOptions {
    /**
     * Backend to use for every request. Defaults to lazy per-request selection
     * via {@link selectSudoBackend} so the environment is probed at call time.
     * Tests inject a deterministic backend here.
     */
    backend?: SudoBackend;
    /** Logger seam; defaults to `console.warn`. */
    warn?: (message: string) => void;
}
/** Register the sudo approval endpoint on the Express app. */
export declare function registerSudoApproveEndpoint(app: Express, options?: SudoEndpointOptions): void;