import type { ToolResult } from "../types.js";
import type { ToolRunOptions } from "./tool-types.js";
/**
 * Run an nmap scan, transparently obtaining the privileges a stealth/raw
 * scan needs and falling back to an unprivileged TCP connect scan when those
 * privileges can't be obtained (no sudo, password declined, etc.).
 *
 * Strategy:
 *   1. Single-host port scans get -Pn so failed host-discovery pings do not
 *      report "0 hosts up" while ports are actually open.
 *   2. If the scan needs raw sockets and we're not root, wrap it in the
 *      OS-appropriate elevation helper (sudo / doas / gsudo). Prefer the
 *      secure requestSecret path (TUI); else interactive TTY sudo.
 *   3. If elevation is unavailable, or the privileged attempt fails in a way
 *      that looks like a permission/privilege error, retry as `-sT` (TCP
 *      connect) which works for any user on every OS.
 *   4. If a run still looks like "host down / 0 hosts up" without -Pn, retry
 *      once with -Pn before returning.
 */
export type NmapScanDepth = "standard" | "deep" | "full";
export interface NmapTimeoutPolicy {
    readonly depth: NmapScanDepth;
    readonly timeoutMs: number;
    readonly source: "profile" | "environment" | "call";
}
/** Resolve a resource-aware timeout from the effective Nmap argv.
 * CLAI_NMAP_TIMEOUT_MS is an operator override, primarily for CI and tightly
 * controlled environments; invalid/unsafe values are ignored.
 */
export declare function resolveNmapTimeoutPolicy(argv: readonly string[], env?: NodeJS.ProcessEnv): NmapTimeoutPolicy;
export declare function runNmapScan(argv: string[], options?: ToolRunOptions, timeoutMsOverride?: number): Promise<ToolResult>;