/**
 * Zero-dependency structural parser for GitHub Actions workflow files (v5.7).
 *
 * The legacy github-actions-scanner.ts matches regexes line-by-line and never
 * understands a workflow's STRUCTURE - which trigger fires it, what permissions
 * its token carries, or which step checks out / uploads / downloads what. That
 * blindness is exactly why the "Cordyceps" class of composition attacks
 * (novee.security, 2026) stays green on single-file scanners: no individual
 * line is wrong, the danger is in how the pieces connect.
 *
 * This parser extracts just enough structure to reason about triggers and data
 * flow, WITHOUT taking on a full YAML dependency (which would itself add
 * supply-chain surface to a supply-chain tool). It is intentionally scoped to
 * the shapes real workflows use: `on:` (scalar / flow-list / block), top-level
 * and per-job `permissions:`, and `jobs -> steps` with each step's
 * `uses` / `run` / `with.ref` / `with.script` / `with.name`.
 */
export interface WfPermissions {
    /** true when a `permissions:` key is present at this scope */
    declared: boolean;
    /** `permissions: write-all` */
    writeAll: boolean;
    /** `permissions: read-all` or `permissions: {}` */
    readAll: boolean;
    /** individual scope -> access level, e.g. { contents: "write", "id-token": "write" } */
    scopes: Record<string, string>;
}
export interface WfStep {
    /** 1-based line of the step's first line */
    line: number;
    uses?: string;
    run?: string;
    withRef?: string;
    withScript?: string;
    withName?: string;
    /** agent prompt text from with.prompt / direct_prompt / override_prompt / user_prompt (joined) */
    withPrompt?: string;
    /** token handed to the step via with.github_token / gh_token / token */
    withToken?: string;
    /** step-level `env:` map (raw values, expressions preserved) */
    env?: Record<string, string>;
}
export interface WfJob {
    id: string;
    line: number;
    permissions: WfPermissions;
    steps: WfStep[];
}
export interface WorkflowAst {
    /** the workflow's display name (`name:`), used to match `workflow_run.workflows` */
    name?: string;
    /** event names under `on:` (e.g. ["pull_request_target", "workflow_run"]) */
    triggers: string[];
    /** names listed under `on.workflow_run.workflows` (the producer workflows) */
    workflowRunWorkflows: string[];
    /** top-level token permissions */
    permissions: WfPermissions;
    jobs: WfJob[];
}
export declare function parseWorkflow(content: string): WorkflowAst;
//# sourceMappingURL=workflow-ast.d.ts.map