export type ProviderTrust = 'user-custom' | 'trusted' | 'trusted-with-scripts' | 'external-safe' | 'external-untrusted';
export type ProviderLayer = 'user' | 'upstream' | 'external';
export interface ProviderManifestShape {
    /** Has a `tui` block — SDK builders consume it as code paths. */
    hasTui: boolean;
    /** Has a non-empty `overrides` object — JS override paths. */
    hasOverrides: boolean;
    /** compatibility[].scriptDir or defaultScriptDir is set — JS scripts dir. */
    hasScriptDir: boolean;
}
/**
 * Inspect a manifest to decide whether it ships JavaScript hooks.
 * Cheap; pure; safe to call on every provider load.
 */
export declare function inspectManifestShape(manifest: Record<string, unknown>): ProviderManifestShape;
/**
 * Classify trust given the layer the provider was loaded from + the
 * manifest's JS-hook footprint.
 */
export declare function classifyTrust(layer: ProviderLayer, shape: ProviderManifestShape): ProviderTrust;
/**
 * Returns true when activation should require an explicit user confirm.
 * Today only `external-untrusted` qualifies; future trust levels may
 * fold in here.
 */
export declare function requiresConfirmation(trust: ProviderTrust): boolean;
/**
 * Render a short human-readable rationale for the trust tag. Used by
 * the dashboard's confirmation modal and the provider catalog tooltip.
 */
export declare function describeTrust(trust: ProviderTrust): string;
