export type AccessMode = 'read' | 'write' | 'network' | 'unknown';
export interface AccessViolation {
    syscall: string;
    path: string;
    reason: string;
    access: AccessMode;
    pid: number;
    traceFile: string;
    line: number;
    raw: string;
}
export interface AccessProbePolicy {
    workspace: string;
    cortexHome: string;
    logsDir: string;
    installRoot: string;
    hostHome: string;
    hostCortexHome: string;
    nodeExecutable: string;
    nodeModuleRoots?: string[];
    tracedPids?: ReadonlySet<number>;
}
export interface AccessProbeCounts {
    traceLines: number;
    fileCalls: number;
    networkCalls: number;
    allowed: number;
}
export interface TraceClassification {
    violations: AccessViolation[];
    counts: AccessProbeCounts;
}
export interface AccessTraceOptions {
    policy: AccessProbePolicy;
    initialCwd: string;
    pid: number;
    traceFile: string;
}
export declare class AccessTraceClassifier {
    private readonly options;
    private readonly counts;
    private readonly pending;
    private readonly processes;
    private readonly symlinks;
    private readonly violations;
    private rootPid;
    constructor(options: AccessTraceOptions);
    private eventOptions;
    private processState;
    private inheritProcess;
    private updateSymlinks;
    private updateProcessState;
    private classifyCall;
    private classifyBody;
    private startPending;
    private finishPending;
    consume(raw: string): void;
    finish(): TraceClassification;
}
export declare function classifyTraceLines(lines: string[], options: AccessTraceOptions): TraceClassification;
export declare function classifyTraceStream(input: NodeJS.ReadableStream, options: AccessTraceOptions): Promise<TraceClassification>;