import type { SafetyConfig } from './safety-middleware.js';
import type { SafetyEvaluation, SafetyOperation, SafetyRule } from './types.js';
/**
 * Extract a job ID from a URL path if it's a job execution endpoint.
 *
 * Matches patterns like:
 * - `/s/-/dw/data/v24_5/jobs/sfcc-site-archive-import/executions`
 * - `/jobs/sfcc-site-archive-export/executions`
 */
export declare function extractJobIdFromPath(path: string): string | undefined;
/**
 * SafetyGuard evaluates operations against safety rules and levels.
 *
 * The guard provides three levels of API:
 * - {@link evaluate} — returns a {@link SafetyEvaluation} describing what should happen
 * - {@link assert} — throws {@link SafetyBlockedError} or {@link SafetyConfirmationRequired}
 * - {@link temporarilyAllow} — creates a scoped exemption for confirmed operations
 *
 * The HTTP middleware uses the guard internally so all HTTP requests are
 * evaluated automatically. CLI commands and other consumers can use the
 * guard directly for richer safety interaction (command-level checks,
 * confirmation flows).
 *
 * @example
 * ```typescript
 * const guard = new SafetyGuard({
 *   level: 'NO_UPDATE',
 *   confirm: true,
 *   rules: [{ job: 'sfcc-site-archive-export', action: 'allow' }],
 * });
 *
 * const evaluation = guard.evaluate({ type: 'job', jobId: 'sfcc-site-archive-export' });
 * // evaluation.action === 'allow'
 * ```
 */
export declare class SafetyGuard {
    readonly config: SafetyConfig;
    private temporaryAllows;
    private readonly logger;
    constructor(config: SafetyConfig);
    /**
     * Evaluate an operation against safety rules and level.
     *
     * Evaluation order:
     * 1. Temporary allows (from confirmed retries) — if matched, allow
     * 2. Config rules in order — first matching rule's action wins
     * 3. Level-based default — confirm if `confirm: true`, otherwise block/allow
     *
     * All evaluations are trace-logged for diagnostics.
     */
    evaluate(operation: SafetyOperation): SafetyEvaluation;
    /**
     * Assert that an operation is allowed.
     *
     * @throws {SafetyBlockedError} if the operation is blocked
     * @throws {SafetyConfirmationRequired} if the operation needs confirmation
     */
    assert(operation: SafetyOperation): void;
    /**
     * Create a temporary exemption for a confirmed operation.
     *
     * Returns a cleanup function that removes the exemption. Use this
     * to retry an operation after the user has confirmed.
     */
    temporarilyAllow(operation: SafetyOperation): () => void;
    /**
     * Add a temporary safety rule for a scoped exemption.
     *
     * Unlike {@link temporarilyAllow} which derives a rule from an operation,
     * this accepts an arbitrary rule — useful for granting broad temporary
     * access (e.g., allowing WebDAV DELETE on Impex paths during a job export).
     *
     * Returns a cleanup function that removes the rule.
     */
    temporarilyAddRule(rule: SafetyRule): () => void;
    /**
     * Evaluate an operation using only the safety level (no rules).
     */
    private evaluateByLevel;
    /**
     * Convert an operation to a temporary allow rule for retry.
     */
    private operationToRule;
    /**
     * Describe why a rule matched, for user-facing messages.
     */
    private describeRuleMatch;
    /**
     * Describe why the level blocked an operation, for user-facing messages.
     */
    private describeLevelBlock;
}