import type { MCPToolDefinition } from '../../types/connector/index.js';
/**
 * What a host will accept from an MCP server.
 *
 * Discovery used to take whatever the server offered, which puts the
 * REMOTE side in charge of what enters the agent's tool registry — the
 * exact inversion of least privilege. A server could add a tool between
 * two turns and it became callable with no one having agreed to it.
 */
export interface MCPToolPolicy {
    /**
     * Names (as the SERVER reports them, before the `mcp_<server>_` prefix)
     * that may be admitted. When set, nothing else is, and a tool that
     * appears later is refused by default rather than admitted by default.
     */
    readonly allow?: readonly string[];
    /** Names that are never admitted, even if `allow` lists them. */
    readonly deny?: readonly string[];
}
export interface MCPToolPolicyDecision {
    readonly admitted: MCPToolDefinition[];
    /** Refused tools, with the reason, so a host can log or surface them. */
    readonly refused: ReadonlyArray<{
        name: string;
        reason: 'not_allowed' | 'denied';
    }>;
}
/**
 * Apply a policy to one server's advertised tools.
 *
 * Deny beats allow. A name on both lists is refused — the restrictive
 * reading is the only safe one when a config contradicts itself.
 */
export declare function applyToolPolicy(tools: readonly MCPToolDefinition[], policy: MCPToolPolicy | undefined): MCPToolPolicyDecision;
/**
 * The same admission decision, for anything a server advertises by name.
 *
 * Factored out because prompts need it too. A server publishing a prompt is
 * the same trust question as one publishing a tool — the remote side must
 * not decide what enters the agent's registry — and two copies of an
 * allow/deny check are two chances for one of them to drift permissive.
 */
export declare function applyNamePolicy<T extends {
    readonly name: string;
}>(items: readonly T[], policy: MCPToolPolicy | undefined): {
    admitted: T[];
    refused: Array<{
        name: string;
        reason: 'not_allowed' | 'denied';
    }>;
};
/**
 * A stable fingerprint of what a server is offering.
 *
 * Covers each tool's name, description and input schema — everything the
 * model is shown and everything that determines what a call does. A server
 * can advertise a benign tool at approval time and swap its description or
 * schema afterwards; nothing about the tool NAME changes, so a name-only
 * check would miss it entirely.
 *
 * Sorted by name and serialized with sorted keys so the hash reflects
 * meaning rather than transport ordering.
 */
export declare function toolsHash(tools: readonly MCPToolDefinition[]): string;
/** What changed between two discoveries of the same server. */
export interface MCPToolDrift {
    readonly added: string[];
    readonly removed: string[];
    /** Same name, different description or schema — the rug-pull shape. */
    readonly changed: string[];
}
export declare function diffTools(before: readonly MCPToolDefinition[], after: readonly MCPToolDefinition[]): MCPToolDrift;
export declare function hasDrift(drift: MCPToolDrift): boolean;
//# sourceMappingURL=policy.d.ts.map