/**
 * Tool Intelligence Engine — Hivemind-owned runtime tool decision engine.
 *
 * This engine evaluates tool calls before execution using session hierarchy,
 * agent role, delegation depth, tool arguments, and CapabilityGate baseline.
 * It is **independent** of OpenCode's native `permission:` allow/ask/deny
 * system and does not consult it as an authority.
 *
 * Initial narrow rules cover:
 * 1. Allow native `task` for front-facing/root orchestration when valid dispatch shape
 * 2. Block native `task` inside child sessions without JIT grant
 * 3. Block `delegate-task` for code/artifact editing intent → recommend native `task`
 * 4. Block malformed task calls missing subagent target
 * 5. Unknown cases fall back to allow (existing governance still runs)
 *
 * @module tool-intelligence
 */
import type { ToolIntelligenceEvent, ToolIntelligenceDecision, ToolIntelligenceGuidance } from "./types.js";
export type { ToolIntelligenceEvent, ToolIntelligenceDecision, ToolIntelligenceDecisionKind, ToolIntelligenceGuidance, JITGrant, } from "./types.js";
/**
 * Config-side severity for governance rules. Mirrors the enum in
 * `.hivemind/configs.schema.json` (governance.rules[].action.type).
 * - `escalate` and `needs_jit_grant` are both mapped to the runtime kind
 *   `needs_jit_grant` — they require an explicit JIT grant before proceeding.
 */
export type GovernanceActionType = "allow" | "warn" | "block" | "escalate" | "needs_jit_grant";
/**
 * Build a structured guidance object for block/warn decisions.
 */
/**
 * Render guidance as a human-readable multi-line string for error messages.
 */
export declare function renderGuidance(g: ToolIntelligenceGuidance): string;
/**
 * Runtime tool intelligence engine.
 *
 * Stateless evaluation of tool calls against Hivemind policy. JIT grants
 * are tracked in-memory for the current process lifetime.
 */
export declare class ToolIntelligenceEngine {
    private readonly jitGrants;
    /**
     * The full ordered list of governance rules, populated from
     * `.hivemind/configs.json` `governance.rules[]` at construction.
     * `evaluateToolCall` walks this list and returns the first matching
     * rule's severity. If no rule matches, the `default` rule wins
     * (or hardcoded `allow` if no `default` rule exists).
     *
     * Per binding contract: severity is fully driven by config, never hardcoded.
     */
    private readonly rules;
    constructor(governanceRules?: ReadonlyArray<{
        id: string;
        enabled?: boolean;
        condition?: {
            toolNames?: ReadonlyArray<string>;
            sessionIDs?: ReadonlyArray<string>;
            depth?: {
                min?: number;
                max?: number;
            };
        };
        action: {
            type: GovernanceActionType;
        };
    }>);
    /**
     * Test whether a single rule's condition matches the incoming event.
     */
    private ruleMatches;
    /**
     * Walk the rules list and return the first enabled rule that matches.
     * Falls back to the rule with id `default`, or `undefined` if none.
     *
     * R-prefix filter: when a detector fired and propagated `detectorRuleId`,
     * rules whose id starts with `R\d+-` only match if their id equals the
     * detector's id. This prevents a config rule like
     * `R4-delegate-task-code-intent` (with `toolNames: ["delegate-task"]`)
     * from matching every `delegate-task` call regardless of intent — the
     * walker must only honor R-prefixed rules when the corresponding detector
     * actually classified the event. Non-R rules (e.g. depth or toolName-only
     * rules authored by users) still match by `toolNames`/`sessionIDs`/`depth`.
     */
    private findMatchingRule;
    /**
     * Resolve decision severity for a tool call. Fully config-driven.
     * Per binding contract: status is driven by `.hivemind/configs.json`;
     * never hardcoded. Hardcoded `allow` is the LAST resort when no rule
     * matches AND no `default` rule is configured.
     *
     * `detectorRuleId` is propagated to the rule walker so R-prefixed
     * config rules only fire when the corresponding detector fired.
     */
    private resolveFromConfig;
    /**
     * Grant a JIT capability for a specific session+agent+tool.
     * The key is `${sessionID}:${agentName}:${toolName}`.
     */
    grantJIT(sessionID: string, agentName: string, toolName: string, reason: string): void;
    /**
     * Check whether a JIT grant exists for the given tuple.
     */
    hasJITGrant(sessionID: string, agentName: string, toolName: string): boolean;
    /**
     * Evaluate a tool call and return a decision.
     *
     * This is the main entry point called from `tool.execute.before`.
     * Rules are evaluated in priority order; the first matching rule wins.
     * If no rule matches, the decision defaults to `allow`.
     */
    evaluateToolCall(event: ToolIntelligenceEvent): ToolIntelligenceDecision;
}
/**
 * Reset the shared singleton. Used by tests and by config-reload hooks.
 * After reset, the next `getToolIntelligenceEngine()` call rebuilds the engine
 * from the current `.hivemind/configs.json` governance rules.
 */
export declare function resetToolIntelligenceEngine(): void;
/**
 * Get the shared ToolIntelligenceEngine singleton.
 * Lazily created on first access. On first creation, the engine reads
 * `.hivemind/configs.json` `governance.rules[]` and uses the `action.type`
 * of each enabled rule to override the per-rule severity.
 *
 * Per binding contract: severity is never hardcoded; it is config-driven.
 * Default severity is `warn` when no rule matches.
 */
export declare function getToolIntelligenceEngine(): ToolIntelligenceEngine;
//# sourceMappingURL=index.d.ts.map