import { type EnforceDecision } from '../../services/sop/gate-enforce-service.js';
import { type ToolCallKind } from '../../services/hooks/worktree-authorization-gate.js';
import { type ProgramIO } from '../cli-helpers.js';
export type GateEnforceCliOptions = {
    project: string;
    json?: boolean;
};
/** The SOP deny variant of the enforcement decision. */
type SopDeny = Extract<EnforceDecision, {
    decision: 'deny';
}>;
/** The SOP allow variant of the enforcement decision. */
type SopAllow = Extract<EnforceDecision, {
    decision: 'allow';
}>;
/**
 * Parse the raw stdin payload, failing open to `null` on malformed JSON.
 */
export declare function parseHookStdin(raw: string): unknown;
/**
 * Map Claude Code tool name to the gate's internal `ToolCallKind`. Anything we don't recognize
 * returns `'Other'` — the worktree gate is opt-in by tool, so unknown tools short-circuit to allow.
 */
export declare function classifyTool(toolName: string | undefined): ToolCallKind;
/**
 * Detect the IDE + adapter and return the adapter's tool matcher. For slice #1 only the Claude
 * adapter is registered, so the payload parser is Claude-shaped. Future slices dispatch on `ide`
 * to pick a per-adapter parser; the parser entry-point (`parseXxxShapeStdin`) is the only change
 * required.
 *
 * The Bash-surface predicate itself stays in `runGateEnforceAction`: TypeScript's aliased-condition
 * narrowing needs `isBashSurface` (which embeds `typeof command === 'string'`) computed in the same
 * scope where `command` is later read, so the extraction stops at the adapter lookup.
 */
export declare function resolveToolMatcher(parsedStdin: unknown): string;
/**
 * Run the fail-closed worktree authorization gate for a gated tool kind. Returns `true` when the
 * call was denied (a hard block has already been emitted and the handler must stop) and `false`
 * when the flow should continue to the SOP gate. `Other` tool kinds are not gated at all.
 *
 * gate. The worktree gate is narrower than the SOP gate (it only inspects a small set of
 * worktree-mutating operations) and is fail-CLOSED. The two layers are complementary: SOP gates
 * decide "may this command run under this SOP's state", the worktree gate decides "did the user
 * explicitly authorize this worktree-mutating operation in the current task". The worktree gate is
 * cheap and self-contained, so it runs first to give the LLM a clear error reason before the SOP
 * gate would otherwise allow.
 *
 * wtDecision may have arrived via lease (viaLease != null); the SOP gate does not care which path
 * granted, only that the worktree gate said allow.
 */
export declare function handleWorktreeGate(io: ProgramIO, options: GateEnforceCliOptions, toolKind: ToolCallKind, payload: {
    command: string | undefined;
    parsedStdin: unknown;
}): boolean;
/**
 * Not a guarded surface — allow. Emit minimal JSON on stdout so Claude Code's PreToolUse hook
 * validator accepts the response. Empty stdout is rejected with "Hook JSON output validation
 * failed — Invalid input" in Claude Code 2.x; `{}` is the canonical no-op marker.
 */
export declare function emitAllowSkipped(io: ProgramIO, options: GateEnforceCliOptions): void;
/** Worktree gate allowed and this is not a Bash surface — allow without running the SOP gate. */
export declare function emitAllowWorktree(io: ProgramIO, options: GateEnforceCliOptions): void;
/**
 * writes the Claude Code permissionDecision:"deny" JSON to stdout (the hook's decision signal),
 * sets process.exitCode = 2 (Claude Code's block exit code), AND surfaces the reason to stderr so
 * the LLM sees it on the next turn. This prevents the previous behaviour where Claude Code wrapped
 * the output as "PreToolUse:Bash hook error".
 */
export declare function emitSopDeny(io: ProgramIO, options: GateEnforceCliOptions, decision: SopDeny): void;
/** Surface any SOP-gate warnings as hints before the allow decision is emitted. */
export declare function emitSopWarnings(io: ProgramIO, decision: SopAllow): void;
/**
 * SOP gate allowed the command. --json mode emits the canonical envelope on stdout (the documented
 * contract for downstream tooling). The hook decision (allow/deny) is still signalled via
 * emitHint here was wrong — emitHint writes to stderr, but the AC5 contract expects the JSON
 * envelope on stdout. Switch to printResult(asJson=true).
 */
export declare function emitSopAllow(io: ProgramIO, options: GateEnforceCliOptions, decision: SopAllow): void;
export {};