/**
 * SQL Console Query Classifier
 *
 * Categorises an SQL query as read / write / reject for the local dashboard
 * SQL console. Used by visualization-server's `/api/sql` endpoint to enforce
 * a defensive allow-list that the original `startsWith()` check could bypass
 * via a CTE prefix (e.g. `WITH t AS (SELECT 1) INSERT INTO ...`).
 *
 * Design goals:
 *  - Fail closed: anything we cannot classify becomes `reject`.
 *  - No SQL grammar: just a defensive peek past leading comments and CTEs
 *    to find the FIRST real keyword.
 *  - Cheap and synchronous — runs in the request hot path.
 */
export type SqlClassification = {
    kind: 'read';
} | {
    kind: 'write';
    operation: 'INSERT' | 'UPDATE' | 'DELETE' | 'REPLACE' | 'ALTER' | 'CREATE';
} | {
    kind: 'destroy';
    operation: 'DROP' | 'TRUNCATE';
} | {
    kind: 'reject';
    reason: string;
};
/**
 * Classify a query as read / write / destroy / reject.
 *
 * Fail-closed: any structure we can't confidently classify becomes `reject`.
 */
export declare function classifySqlQuery(rawQuery: string): SqlClassification;
