/**
 * Pure mode × code-has-writes × autoApprove × surface → approval-or-block decision.
 *
 * Decision matrix:
 *
 *   mode      | code has writes | autoApprove | outcome
 *   ----------|-----------------|-------------|---------------------------------
 *   Ask/Plan  | no              | any         | allow ReadOnly,  no approval
 *   Ask/Plan  | yes             | any         | blocked (writes in read-only mode)
 *   Action    | no              | any         | allow ReadOnly,  no approval
 *   Action    | yes             | true        | allow ReadWrite, no approval (auto)
 *   Action    | yes             | false       | allow ReadWrite, approval required
 *
 * `btw=true` (internal "behave-the-way" override) forces Ask/Plan semantics
 * regardless of declared mode. Pure, no I/O, no side effects.
 */
import { type AgentExecuteCodeMode as AgentExecuteCodeModeValue, type ExecuteCodeSurface } from '../../../contracts/agent-execute-code.js';
import type { ApprovalRequirement } from '../../../contracts/host-tool.js';
export declare const ExecuteCodeAccess: {
    readonly ReadOnly: "readOnly";
    readonly ReadWrite: "readWrite";
};
export type ExecuteCodeAccess = (typeof ExecuteCodeAccess)[keyof typeof ExecuteCodeAccess];
type ExecuteCodeAccessValue = ExecuteCodeAccess;
export interface ClassifyExecuteCodeInput {
    readonly autoApprove: boolean;
    readonly btw?: boolean;
    readonly code: string;
    readonly mode: AgentExecuteCodeModeValue;
    readonly surface: ExecuteCodeSurface;
}
export type ClassifyExecuteCodeOutcome = {
    readonly kind: 'allow';
    readonly access: ExecuteCodeAccessValue;
    readonly approval: ApprovalRequirement;
} | {
    readonly kind: 'blocked';
    readonly disallowed: readonly string[];
};
export declare function classifyExecuteCode(input: ClassifyExecuteCodeInput): ClassifyExecuteCodeOutcome;
/** Project params.access + autoApprove onto the approval requirement (no code analysis). */
export declare function evaluateAccessApproval(access: ExecuteCodeAccessValue, autoApprove: boolean): ApprovalRequirement;
export {};
//# sourceMappingURL=classify.d.ts.map