import type { OrgBus } from './bus.js';
import type { RolePolicy } from './types.js';
export type Decision = {
    behavior: 'allow';
    updatedInput: Record<string, unknown>;
} | {
    behavior: 'deny';
    message: string;
};
/**
 * tiny glob→RegExp: `**\/` matches zero-or-more leading directories (so
 * `**\/*.md` matches both `README.md` and `docs/README.md`, standard glob
 * semantics), bare `**` matches any depth, `*` matches one path segment.
 */
export declare function globToRegExp(glob: string): RegExp;
export declare class PolicyEngine {
    readonly role: string;
    readonly policy: RolePolicy;
    private bus;
    private cwd;
    private used;
    /** ORG-7: accumulated USD cost for this role, mirrors `used` (tokens). */
    private usedUsd;
    constructor(role: string, policy: RolePolicy, bus: OrgBus, cwd: string);
    addUsage(tokens: number): void;
    get usage(): number;
    /** Set usage counter directly for checkpoint/resume - Pattern 3 */
    setUsage(tokens: number): void;
    get overBudget(): boolean;
    /** ORG-7: accumulate real USD cost (from 'usage' bus events' data.cost_usd). */
    addUsageUsd(costUsd: number): void;
    get usageUsd(): number;
    /** Set USD usage counter directly for checkpoint/resume, mirrors setUsage(). */
    setUsageUsd(costUsd: number): void;
    /** ORG-7: parallel to overBudget (token), but for the role's USD spend cap
     *  (policy.maxUsd, from OrgRole.budget_usd). Unset maxUsd means no USD
     *  enforcement for this role — only overBudget (tokens) applies. */
    get overBudgetUsd(): boolean;
    decide(tool: string, input: Record<string, unknown>): Promise<Decision>;
}
/** webAllow entry matcher. `*` allows any host (the intuitive "no
 *  restriction" value); `*.example.com` matches the bare domain and every
 *  subdomain; anything else is an exact host or subdomain suffix match. */
export declare function webDomainMatches(pattern: string, host: string): boolean;
//# sourceMappingURL=policy.d.ts.map