import type { ToolCall } from './tools.js';
/**
 * Per-pattern approval metadata. Lets policy authors route specific
 * tools/commands to a named audience (e.g. `'reviewer'`,
 * `'compliance-team'`, `'project-admin'`). The audience id is opaque to
 * fabric-harness — host applications map ids to humans via their own
 * identity layer.
 */
export interface ApprovalPolicyRule {
    /** Glob pattern matched against the tool/command name. */
    pattern: string;
    /** Opaque audience id passed through on the approval_requested event. */
    audience: string;
    /** Default reason text. Templates allowed: ${name}. */
    reason?: string;
    /** Time-to-live for the approval request in seconds. Default 24h. */
    ttlSeconds?: number;
}
export interface CommandPolicy {
    allow?: string[];
    deny?: string[];
    requireApproval?: string[];
    /** Declarative per-pattern approval routing. Evaluated before requireApproval. */
    approvalRules?: ApprovalPolicyRule[];
}
export interface ToolPolicy {
    allow?: string[];
    deny?: string[];
    requireApproval?: string[];
    /** Declarative per-pattern approval routing. Evaluated before requireApproval. */
    approvalRules?: ApprovalPolicyRule[];
}
export type ApprovalRisk = 'low' | 'medium' | 'high';
export interface ApprovalEscalationPolicy {
    afterMs: number;
    notify?: string[];
    risk?: ApprovalRisk;
}
export interface FilesystemPolicy {
    /** Backward-compatible read allowlist. */
    read?: string[];
    /** Backward-compatible write allowlist. */
    write?: string[];
    readDeny?: string[];
    writeDeny?: string[];
    readRequireApproval?: string[];
    writeRequireApproval?: string[];
}
export interface NetworkPolicy {
    /**
     * `'allowlist'` (default when `hosts` is set) — only listed hosts permitted.
     * `'denylist'` — listed hosts blocked, everything else allowed.
     * `'none'` — block all outbound network. Useful for sandboxed analysis agents.
     */
    mode?: 'allowlist' | 'denylist' | 'none';
    /**
     * Host patterns. Matched as glob against `URL.host`. Supports `*` for
     * single-segment wildcard and `**` for any (e.g. `*.api.example.com`,
     * `**.example.com`).
     */
    hosts?: string[];
    /**
     * Optional protocol allowlist (e.g. `['https:']`). Defaults to allowing
     * `http:` and `https:` only.
     */
    protocols?: string[];
    /** Allow loopback, RFC1918, link-local, and unique-local destinations. Defaults to false. */
    allowPrivateNetwork?: boolean;
    /** Resolve hostnames before each request/redirect and reject private answers. Node uses dns.lookup by default. */
    resolveDns?: boolean;
}
export interface CapabilityPolicy {
    filesystem?: FilesystemPolicy;
    /** Backward-compatible command allowlist. Prefer commandPolicy for new code. */
    commands?: string[];
    commandPolicy?: CommandPolicy;
    toolPolicy?: ToolPolicy;
    network?: NetworkPolicy;
    maxCommandTimeoutMs?: number;
    approvals?: {
        /** Backward-compatible command approval patterns. Prefer commandPolicy.requireApproval. */
        requiredFor?: string[];
        defaultTimeoutMs?: number;
        risk?: ApprovalRisk;
        requiredApprovals?: number;
        escalation?: ApprovalEscalationPolicy;
    };
}
export interface PolicyDecision {
    allowed: boolean;
    reason?: string;
    approvalRequired?: boolean;
    risk?: ApprovalRisk;
    matchedPattern?: string;
    /** Audience id from the matched ApprovalPolicyRule, if any. Opaque to fabric-harness. */
    approvalAudience?: string;
    /** Time-to-live in seconds for the approval request. */
    approvalTtlSeconds?: number;
}
export declare function evaluateToolCallPolicy(call: ToolCall, policy?: CapabilityPolicy): PolicyDecision;
export declare function evaluateCommandPolicy(command: string | undefined, policy?: CapabilityPolicy): PolicyDecision;
/**
 * Evaluate a URL or `Request` against the configured network policy. Returns
 * `{ allowed: true }` when the request is permitted, otherwise a denial with
 * the reason and matched pattern.
 */
export declare function evaluateNetworkPolicy(input: string | URL | Request, policy?: CapabilityPolicy): PolicyDecision;
/**
 * Wrap a `fetch`-like function with `CapabilityPolicy` enforcement. Tools and
 * connectors that make outbound HTTP should accept a custom `fetch` and pass
 * the result of `policiedFetch(fetch, policy)`.
 *
 * Throws a `FabricError` (`POLICY_DENIED`) when a request violates the policy;
 * never sends a forbidden request.
 */
export interface PoliciedFetchOptions {
    resolveHostname?: (hostname: string) => Promise<string[]>;
}
/**
 * Wrap a Fetch implementation with URL, protocol, host, redirect, and optional
 * DNS-answer checks from a capability policy.
 *
 * This wrapper governs only calls made through the returned function; it does
 * not intercept global Fetch, Axios, raw sockets, subprocesses, or third-party
 * clients. Pair it with a container, cluster, or provider egress boundary for
 * untrusted production workloads.
 *
 * @throws FabricError with `POLICY_DENIED` before a forbidden request is sent.
 */
export declare function policiedFetch(fetchImpl: typeof fetch, policy?: CapabilityPolicy, options?: PoliciedFetchOptions): typeof fetch;
export declare function clampCommandTimeout(timeout: number | undefined, policy?: CapabilityPolicy): number | undefined;
//# sourceMappingURL=policy.d.ts.map