import type { OperationClassification } from "./operation-classifier.js";
import type { PermissionMode, PermissionBehavior, PermissionResult, PermissionRuleEntry, PermissionEngineConfig, ToolPermissionCheckInput } from "./types.js";
export declare class PermissionRuleEngine {
    private mode;
    private rules;
    private sessionRules;
    private compiledPatterns;
    constructor(config: PermissionEngineConfig);
    getMode(): PermissionMode;
    setMode(mode: PermissionMode): void;
    getRules(): readonly PermissionRuleEntry[];
    /** Replace all persistent rules at once (for settings hot-reload). Session rules are preserved. */
    replaceRules(rules: PermissionRuleEntry[]): void;
    addRule(rule: PermissionRuleEntry): void;
    /** Add a session-scoped rule (e.g. "remember directory" approvals). */
    addSessionRule(rule: {
        pathPrefix?: string;
        pattern?: string;
        behavior?: PermissionBehavior;
    }): void;
    /** sandbox 可写根:rules + sessionRules 中 allow 且带 pathPrefix 的目录(去重)。 */
    getAllowedWriteDirectories(): string[];
    /**
     * Workspace + danger decision pipeline.
     *
     * `op` is optional and defaults to an all-false classification so callers
     * that have not yet been wired to the classifier keep compiling.
     */
    check(input: ToolPermissionCheckInput, op?: OperationClassification, ctx?: {
        extraRules?: readonly PermissionRuleEntry[];
    }): PermissionResult;
    /** Rebuild compiledPatterns: [persistent-deny] → [session] → [persistent non-deny]. */
    private recompile;
    private matchCompiledRules;
    /**
     * Match a caller-supplied rule set (deny-first) against this call, using the SAME
     * matching semantics as the base rules (pathPrefix prefix-match, else toolName glob).
     * Returns the first hit's result, or null if none match. Used for per-call scoped
     * rules (community-skill turns) so trust-level restrictions stay in the one engine.
     */
    private matchRuleSet;
}
/**
 * Parse permission config from Gateway-injected or local settings.
 *
 * Accepts the user-facing permission mode plus the persistent `rules` channel.
 * Legacy top-level alias keys (allow/deny/ask arrays, default) are still rejected.
 */
export declare function parsePermissionConfig(raw: unknown): PermissionEngineConfig;
