/**
 * Capability audit logging and Deno permission mapping.
 *
 * @module extensions/capabilities
 */
import type { Capability, ExtensionLogger } from "./types.js";
/**
 * Format capabilities as human-readable strings for logging.
 *
 * The input is descriptor-snapshotted before formatting so accessors, proxies,
 * or later mutation cannot turn startup audit logging into a second execution
 * of untrusted extension metadata.
 */
export declare function formatCapabilities(capabilities: Capability[]): string[];
/** @internal */
export declare function isSupportedDenoSystemReadApi(value: string): boolean;
/**
 * Descriptor-snapshot and validate one extension's capability metadata before
 * either admission or permission serialization.
 *
 * @internal
 */
export declare function snapshotRuntimeCapabilities(value: unknown): readonly Capability[];
/**
 * Validate the known capability grammar used by both extension admission and
 * Deno permission mapping. Unknown capability types remain extensible.
 *
 * @internal
 */
export declare function assertKnownCapabilitySchema(capability: Capability, index: number, type: string): void;
/** Validate the bounded scope required by a `system:read` capability. */
export declare function assertSystemReadCapability(capability: Capability): void;
/**
 * Map capabilities to Deno CLI permission flags.
 *
 * Skips capabilities without a Deno permission mapping. Recognized capability
 * types are validated at runtime and throw `TypeError` rather than emitting an
 * invalid or unexpectedly broad permission flag.
 */
export declare function mapToDenoPermissions(capabilities: Capability[]): string[];
/**
 * Log capabilities for a named extension at startup.
 */
export declare function auditCapabilities(extensionName: string, capabilities: Capability[], logger: ExtensionLogger): void;
//# sourceMappingURL=capabilities.d.ts.map