import type { ActorIdentity, ApprovalPolicyRule, CapabilityPolicy, FabricPrincipal, JsonObject, ToolDef } from "@fabric-harness/sdk";
/**
 * Governance for Databricks tools is **layered on top of Unity Catalog, never a replacement.** UC
 * enforces table/row/column ACLs natively via the acting principal (see identity.ts). These helpers
 * add the things UC doesn't: an **audit/lineage** stamp on every tool call, **approval routing** for
 * sensitive operations, and an **egress allowlist** pinned to the workspace — all expressed through
 * the SDK's existing `CapabilityPolicy`, so the loop enforces them without a bespoke engine.
 */
export interface DatabricksLineageRecord {
    tool: string;
    /** From the tool's `metadata.service` (e.g. 'sql', 'unity-catalog', 'jobs'). */
    service?: string;
    provider?: string;
    /** Stable label for the acting principal — never the token. */
    principal?: string;
    /** Durable submission owning this tool call (v2 correlation, from the ambient submission context). */
    submissionId?: string;
    attemptId?: string;
    tenantId?: string;
    catalog?: string;
    schema?: string;
    /** Governed object identifier (table, index, pipeline, job, endpoint, or statement target). */
    object?: string;
    /** Every structured resource declared by the tool. */
    resources?: DatabricksGovernedResource[];
    /** Approval identities are distinct from the principal that executed the call. */
    approvers?: ActorIdentity[];
    /** Tool effect copied from metadata (`read`, `write`, or `execute`). */
    operation?: string;
    /** Stable MCP/session tool-call identity. */
    toolCallId?: string;
    /** Canonical digest binding this record to the exact input. */
    inputDigest?: string;
    /** Effective policy version resolved at the execution boundary. */
    policyVersion?: string;
    input: JsonObject;
    startedAt: string;
    finishedAt: string;
    ok: boolean;
    error?: string;
}
export interface DatabricksGovernanceOptions {
    /** Stable label for the acting principal, recorded in lineage. Never pass a token here. */
    principal?: string;
    /** Sink for lineage/audit records. Defaults to no-op; wire to OTel / `onEvent` at the app layer. */
    onLineage?: (record: DatabricksLineageRecord) => void;
    /**
     * Optional belt-and-suspenders catalog allowlist. Calls whose input references a catalog outside
     * the list are rejected before execution. UC remains the source of truth; this is defense in depth.
     */
    catalogs?: string[];
    /** Verified principal bound to a request-scoped bundle. */
    executingPrincipal?: FabricPrincipal;
    /** Services whose model-exposed calls must carry a valid ApprovalGrant. */
    requireApprovalGrantFor?: string[];
    /** Exact authoring tools whose calls must carry a valid ApprovalGrant. */
    requireApprovalGrantForTools?: string[];
    /** Clock injection for tests. */
    now?: () => Date;
}
export interface DatabricksGovernanceResourceDescriptor {
    kind: string;
    /** Extended JSON Pointer over public camelCase input; `*` matches every array item. */
    path?: string;
    /** Static governed resource bound by a trusted adapter rather than model-supplied input. */
    value?: string;
    catalogQualified?: boolean;
    optional?: boolean;
}
export interface DatabricksGovernanceMetadata {
    resources: DatabricksGovernanceResourceDescriptor[];
    secretFields?: string[];
}
export interface DatabricksGovernedResource {
    kind: string;
    value: string;
    path: string;
    catalog?: string;
}
export declare function governanceMetadata(tool: ToolDef): DatabricksGovernanceMetadata | undefined;
/** Validate descriptor syntax and that each path can be traversed in the declared input schema. */
export declare function validateDatabricksGovernanceDescriptor(tool: ToolDef, required?: boolean): void;
export declare function extractDatabricksGovernedResources(tool: ToolDef, input: unknown): DatabricksGovernedResource[];
/** Wraps one Databricks tool to stamp lineage/audit and enforce the optional catalog allowlist. */
export declare function withGovernance<I, O>(tool: ToolDef<I, O>, options?: DatabricksGovernanceOptions): ToolDef<I, O>;
/** Wraps a set of Databricks tools with {@link withGovernance}. */
export declare function withGovernanceTools(tools: ToolDef[], options?: DatabricksGovernanceOptions): ToolDef[];
export interface DatabricksApprovalRuleOptions {
    /** Opaque approval audience (e.g. 'data-steward'). */
    audience: string;
    /** Restrict to these `metadata.service` values. Default: gate every write/execute tool. */
    services?: string[];
    reason?: string;
    ttlSeconds?: number;
}
/** Builds approval rules (one per gated tool) for `CapabilityPolicy.toolPolicy.approvalRules`. */
export declare function databricksApprovalRules(tools: ToolDef[], options: DatabricksApprovalRuleOptions): ApprovalPolicyRule[];
export interface DatabricksGovernancePolicyOptions {
    tools: ToolDef[];
    /** Workspace host(s) to pin outbound egress to (URL or bare host). */
    host?: string | string[];
    /** When set, sensitive tools route to this approval audience. */
    stewardAudience?: string;
    approvalServices?: string[];
    ttlSeconds?: number;
}
export interface AnalyticsCopilotGovernanceOptions {
    /** Approval audience for arbitrary SQL execution and Genie lifecycle management. */
    stewardAudience: string;
    /** Belt-and-suspenders catalog allowlist enforced before tool execution. */
    catalogs?: string[];
    approvalTtlSeconds?: number;
    /** Stable label recorded in lineage. Never pass a token. */
    principalLabel?: string;
    onLineage?: (record: DatabricksLineageRecord) => void;
}
export interface AnalyticsCopilotGovernance {
    stewardAudience: string;
    /** SQL and Genie are the only authoring services enabled by this focused policy pack. */
    approvalServices: string[];
    catalogs?: string[];
    approvalTtlSeconds?: number;
    principalLabel?: string;
    onLineage?: (record: DatabricksLineageRecord) => void;
}
/**
 * Governance defaults for the analytics-copilot path. Safe Genie questions and `sql_read` carry a
 * read effect and remain interactive; arbitrary SQL execution and Genie lifecycle tools retain
 * steward approval. Enabling another authoring service with this pack fails bundle initialization
 * until the caller deliberately expands its approval scope.
 */
export declare function analyticsCopilotGovernance(options: AnalyticsCopilotGovernanceOptions): AnalyticsCopilotGovernance;
/**
 * Assembles a `CapabilityPolicy` for a Databricks tool set: approval routing for sensitive
 * operations (if `stewardAudience` is set) plus an egress allowlist pinned to the workspace host(s).
 * Used by the `databricks()` bundle; can also be merged into an agent's own policy.
 */
export declare function databricksGovernancePolicy(options: DatabricksGovernancePolicyOptions): CapabilityPolicy;
//# sourceMappingURL=governance.d.ts.map