import { type AutoApproveFinding, type RiskySettingsMode } from './settings-risk-scanner.js';
export interface RiskySettingsGate {
    mode: RiskySettingsMode;
    findings: AutoApproveFinding[];
    /** Display lines: location, reason, sanitized snippet. */
    lines: string[];
    /** True when init must stop (mode `stop` and at least one finding). */
    stop: boolean;
}
export declare function scanAutoApprove(settings: Record<string, unknown>): AutoApproveFinding[];
/** Reads a settings file and judges it; null when the file is absent, unreadable or not a JSON object. */
export declare function checkRiskySettings(settingsPath: string, mode?: RiskySettingsMode): RiskySettingsGate | null;
/**
 * ADR-509 §2.3: the helpers ruflo's hooks launch, as the PROJECT ships them.
 * `init` keeps an existing `.claude/helpers/<name>` unless --force, and the
 * project-scope hook commands prefer the project's copy, so a repository that
 * ships its own hook-handler.cjs runs it under an exact ruflo hook command. A
 * helper is trusted when its bytes are the copy this ruflo ships, or its
 * SHA-256 is in a helpers manifest signed with ruflo's key (this ruflo's, or
 * the project's own, which an older signed release left). Anything else is a
 * finding. A `.LOCKED` helpers dir (deliberate local edits) is skipped, and with
 * no ground truth at all this fails open. `pubkeyPem` is injectable for tests.
 */
export declare function untrustedProjectHelpers(targetDir: string, sourceHelpersDir: string | null, pubkeyPem?: string): AutoApproveFinding[];
/**
 * The init gate: the settings file's auto-approve keys plus the project's
 * untrusted helpers. Null when there is nothing to report.
 */
export declare function checkInitTrust(targetDir: string, mode: RiskySettingsMode, sourceHelpersDir: string | null): RiskySettingsGate | null;
/** `drop`: the settings without the auto-approve keys; otherwise the settings unchanged. */
export declare function applyRiskyMode(settings: Record<string, unknown>, mode: RiskySettingsMode | undefined): {
    settings: Record<string, unknown>;
    dropped: number;
};
/** Reads `--keep-risky-settings` / `--drop-risky-settings` (camel or kebab); both at once is an error. */
export declare function riskyModeFromFlags(flags: Record<string, unknown>): RiskySettingsMode | {
    error: string;
};
//# sourceMappingURL=risky-settings-gate.d.ts.map