/**
 * Runtime permissions safety checks.
 *
 * These checks run first and always, regardless of mode, session overrides,
 * or policy rules. They cannot be disabled by configuration.
 */
import type { CommandClassification, DecisionReason, EvaluationStep } from './types.js';
export interface SafetyCheckResult {
    /** Whether the call is blocked by a safety check. */
    blocked: boolean;
    /** Reason code if blocked (always a SAFETY_* code). */
    reason?: DecisionReason | undefined;
    /** Human-readable explanation for the evaluation trace. */
    detail?: string | undefined;
    /** Steps added to the trace during evaluation (one per check run). */
    steps: EvaluationStep[];
    /** Semantic classification if determined by the safety layer. */
    classification?: CommandClassification | undefined;
}
/**
 * runSafetyChecks, Executes all bypass-immune safety checks for a tool call.
 *
 * Returns a SafetyCheckResult with `blocked: false` if all checks pass,
 * or `blocked: true` with a SAFETY_* reason code and trace step if any check fires.
 *
 * These checks cannot be bypassed by any policy rule, mode, or session override.
 *
 * @param toolName , The tool being called.
 * @param args     , Arguments passed to the tool.
 */
export declare function runSafetyChecks(toolName: string, args: Record<string, unknown>): SafetyCheckResult;
//# sourceMappingURL=safety-checks.d.ts.map