export declare function isSensitiveGitCommand(cmd: string): boolean;
/**
 * v1.3.0 Part A — extract the destination branch a `git push` writes to, so the
 * approval gate can apply the protected-branch guard. Handles the common forms:
 *
 *   git push origin feat/x          → "feat/x"
 *   git push -u origin main         → "main"
 *   git push --set-upstream o dev   → "dev"
 *   git push origin HEAD:feat/x     → "feat/x"   (refspec dst)
 *   git push origin feat/a:feat/b   → "feat/b"   (refspec dst is what's written)
 *   git push                        → null       (current branch — hook resolves)
 *   git push origin                 → null       (remote only — hook resolves)
 *   git push origin HEAD            → null       (HEAD — hook resolves)
 *
 * Returns null when no explicit destination branch is present; the caller
 * resolves the current branch (`git rev-parse --abbrev-ref HEAD`) in that case.
 * Compound commands (`cd repo && git push origin x`) are handled by isolating
 * the `git push` segment first.
 */
export declare function parsePushBranch(cmd: string): string | null;
/**
 * v1.3.0 Part A — is `branch` a protected branch (case-insensitive)? `null`
 * branch (current-branch push the hook will resolve) returns false here; the
 * hook re-checks after resolving the actual ref.
 */
export declare function isProtectedBranch(branch: string | null, protectedBranches: readonly string[]): boolean;