/**
 * Tool Classification for CLI-Level Permission Prompts
 *
 * Provides static classification of Claude Code CLI tool calls and
 * evaluation against active element gatekeeper policies.
 *
 * Used by the permission_prompt operation (Issue #625) to evaluate
 * --permission-prompt-tool requests without requiring LLM evaluation.
 *
 * @module
 */
import type { ActiveElement } from './ElementPolicies.js';
import type { RiskAssessment } from '../GatekeeperTypes.js';
export type ToolRiskLevel = 'safe' | 'moderate' | 'dangerous' | 'blocked';
export interface ToolClassificationResult {
    riskLevel: ToolRiskLevel;
    /** 'allow' = auto-approve, 'deny' = auto-reject, 'evaluate' = check element policies */
    behavior: 'allow' | 'deny' | 'evaluate';
    reason: string;
}
export interface PolicyEvaluationContext {
    evaluatedElements: Array<{
        type: string;
        name: string;
        matched?: 'allowPatterns' | 'confirmPatterns' | 'denyPatterns';
        matchedPattern?: string;
        matchedTarget?: string;
    }>;
    decisionChain: string[];
}
export interface CliToolPolicyResult {
    behavior: 'allow' | 'deny' | 'evaluate' | 'confirm';
    message?: string;
    confirmSource?: string;
    policyContext?: PolicyEvaluationContext;
}
/**
 * Classify a CLI tool call by risk level using static rules.
 *
 * Returns 'allow' for known-safe tools, 'deny' for known-dangerous patterns,
 * and 'evaluate' for anything that needs further policy checking.
 */
export declare function classifyTool(toolName: string, toolInput: Record<string, unknown>): ToolClassificationResult;
/**
 * Assess the risk of a CLI tool call.
 *
 * Returns a numeric score (0-100) and irreversibility indicator based on
 * the static classification and tool-specific heuristics.
 *
 * @param toolName - The tool being called
 * @param toolInput - The tool input parameters
 * @param classification - The result from classifyTool()
 * @returns Risk assessment with score, irreversibility, and contributing factors
 */
export declare function assessRisk(toolName: string, toolInput: Record<string, unknown>, classification: ToolClassificationResult): RiskAssessment;
/**
 * Return all static classification data for bridge policy export.
 *
 * Used by PolicyExportService to write the bridge-compatible policy file.
 * All data is returned as plain arrays/objects (no Sets).
 */
export declare function getStaticPolicyData(): {
    safe_tools: string[];
    safe_bash_patterns: string[];
    dangerous_bash_patterns: string[];
    blocked_bash_patterns: string[];
    irreversible_patterns: string[];
    sensitive_path_prefixes: string[];
    gatekeeper_essential_operations: string[];
    safe_mcp_operations: string[];
    risk_scores: {
        [x: string]: number;
    };
};
/**
 * Evaluate a CLI tool call against active element gatekeeper policies.
 *
 * Four-step evaluation per element (Issue #625 Phase 2, Issue #1660):
 * 1. denyPatterns (highest priority) — first match = immediate deny
 * 1.5. confirmPatterns — first match = immediate confirm (requires approval)
 * 2. allowPatterns — if element defines them, record whether tool matched
 * 3. After all elements: if any had allowPatterns but tool wasn't allowed by any = deny
 *
 * Union semantics: tool must match at least ONE element's allowPatterns (not all).
 * Elements without allowPatterns don't restrict.
 *
 * @example
 * // Tool matches allowPatterns in element A but not B → ALLOWED (union semantics)
 * // Tool matches denyPatterns in any element → DENIED (deny always wins)
 * // Tool matches no allowPatterns but some exist → DENIED ("not in any allowlist")
 * // No allowPatterns defined anywhere → Phase 1 behavior (fall through to default)
 *
 * @returns 'deny' if blocked, 'evaluate' if permitted to fall through to default
 */
export declare function evaluateCliToolPolicy(toolName: string, toolInput: Record<string, unknown>, activeElements: ActiveElement[]): CliToolPolicyResult;
//# sourceMappingURL=ToolClassification.d.ts.map